System security protection method and device and storage medium

Abstract

The application discloses a system security protection method and device and a storage medium, relates to the technical field of system security protection, and comprises the following steps: in response to an operation instruction of a target program, acquiring an object entity corresponding to the operation instruction, wherein the object entity comprises a newly-built service, a sub-process and / or communication interaction with a driver; acquiring feature information corresponding to the object entity; verifying the feature information corresponding to the object entity; and performing system security protection based on the verification result. According to the application, the feature of an object entity related to an operation instruction is extracted, and the feature information of the object entity is verified, so that potential threats can be accurately identified, and malicious objects can be prevented from executing or damaging a system, thereby guaranteeing that Anti Rootkit (ARK) and security software can be normally used, avoiding the damage of security protection software of the system by hackers using the tools and software, and effectively improving the security.

Description

Technical Field

[0001] This application relates to the field of system security protection technology, and in particular to system security protection methods, devices and storage media. Background Technology

[0002] With the development of security countermeasures, many ARK tools (and similar functions in many security software programs) have been developed to remove hidden malware from systems. These tools can forcibly terminate all running processes and violently clean up program files on the disk, making them very powerful. However, hackers can also exploit these functions to disable system security software and then encrypt data for ransomware purposes. Therefore, ensuring that these tools and software are used properly by administrators without being maliciously exploited by hackers has become a pressing technical problem. Summary of the Invention

[0003] The main purpose of this application is to provide a system security protection method, device and storage medium, which aims to solve the technical problem of how to improve the system's ability to defend against various threats.

[0004] To achieve the above objectives, this application proposes a system security protection method, which includes: In response to the operation instructions of the target program, the object entity corresponding to the operation instructions is obtained, and the object entity includes a newly created service, a child process, and / or communication and interaction with the driver. Obtain the feature information corresponding to the object entity; Verify the feature information corresponding to the object entity; System security protection is based on the verification results.

[0005] Optionally, if the object entity is a newly created service, obtaining the feature information corresponding to the object entity includes: Obtain the driver path information corresponding to the newly created service; The driver's characteristic information is determined based on the driver path information.

[0006] Optionally, if the object entity is a subprocess, obtaining the feature information corresponding to the object entity includes: Obtain the program file path information of the child process; The characteristic information of the subprocess is determined based on the program file path information.

[0007] Optionally, verifying the feature information corresponding to the object entity includes: The feature information is compared with the program feature information of a preset malicious program to obtain the comparison result; The verification result of the subprocess is determined based on the comparison results.

[0008] Optionally, before obtaining the object entity corresponding to the operation instruction in response to the operation instruction of the target program, the method further includes: Enumerate all driver services on the system and determine the driver files corresponding to all driver services; System security protection is based on the aforementioned driver file.

[0009] Optionally, when the object entity communicates and interacts with the driver, the system security protection method includes: Obtain communication interaction data between the security software and the driver; The communication interaction data is parsed to obtain the operation object; System security protection is implemented based on the operation object.

[0010] Optionally, before acquiring the communication interaction data between the security software and the driver, the process includes: Determine the device object name for the security software; Determine whether the device object exists in the system based on the device object name; If it exists, a new listening device object is attached to the device object to intercept the communication data between the security software and the driver.

[0011] Optionally, the step of performing system security protection based on the verification results includes: If, based on the verification results, it is determined that there is currently a destructive act, a prompt message is sent, prompting the user to enter a security verification code; Verify the security verification code entered by the user; If the verification passes, respond to the operation command.

[0012] Furthermore, to achieve the above objectives, this application also proposes a system security protection device, which includes: The response module is used to respond to the operation instructions of the target program and obtain the object entity corresponding to the operation instructions. The object entity includes a newly created service, a child process, and / or communication and interaction with the driver. The acquisition module is used to acquire the feature information corresponding to the object entity; The verification module is used to verify the feature information corresponding to the object entity; The system security protection module is used to perform system security protection based on the verification results.

[0013] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the system security protection method described above.

[0014] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the system security protection method described above.

[0015] This application responds to the operation instructions of the target program by obtaining the object entity corresponding to the operation instructions; obtaining the feature information corresponding to the object entity; verifying the feature information corresponding to the object entity; and performing system security protection based on the verification results. By extracting and verifying the feature information of the object entity involved in the operation instructions, this application can accurately identify potential threats, prevent malicious objects from executing or damaging the system, ensure the normal operation of anti-kernel tools (Anti Rootkits, ARKs) and security software, and prevent hackers from using these tools and software to damage the system's security protection software, effectively improving security. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating an embodiment of the system security protection method of this application. Figure 2 This is a flowchart illustrating Embodiment 2 of the system security protection method of this application; Figure 3 This is a flowchart illustrating Embodiment 3 of the system security protection method of this application; Figure 4 This is a flowchart illustrating Embodiment 4 of the system security protection method of this application; Figure 5 This is a schematic diagram of the module structure of the system security protection device in the embodiment of this application; Figure 6 This is a schematic diagram of the device structure of the hardware operating environment involved in the system security protection method in this application embodiment.

[0019] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0020] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0021] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0022] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device or system security protection device capable of performing the above functions. The following description uses a system security protection device as an example to illustrate this embodiment and the subsequent embodiments.

[0023] Based on this, the embodiments of this application provide a system security protection method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating an embodiment of the system security protection method of this application.

[0024] In this embodiment, the system security protection method includes the following steps: Step S10: In response to the operation instruction of the target program, obtain the object entity corresponding to the operation instruction. The object entity includes a newly created service, a child process, and / or communication and interaction with the driver. It should be noted that the target program can be an application, process, service, driver, or system component that initiates an operation (such as file access, process creation, driver loading, registry modification, etc.). It can include malicious programs and security software installed on the system. The security software can be a software program running on top of the operating system to protect the system from malicious attacks (such as viruses, Trojans, illegal drivers, unauthorized access, etc.), typically including but not limited to: antivirus software, firewalls, Host Intrusion Prevention Systems (HIPS), Endpoint Detection and Response Systems (EDR), and security protection software. The operation instruction can be a behavior initiated by the target program, such as opening / reading / writing a file, creating / terminating a process, creating a service, or loading a driver. The object entity can be a specific resource, data, or entity within the system to be operated on by the operation instruction; in this embodiment, it can include drivers and executable programs.

[0025] Step S20: Obtain the feature information corresponding to the object entity; It should be noted that the feature information may include path information corresponding to the object entity, operation object, hash value corresponding to the executable program, import table function, code segment data, etc.

[0026] Step S30: Verify the feature information corresponding to the object entity; It should be noted that the verification of the feature information corresponding to the object entity can be achieved by comparing the feature information with the feature information of a preset program to be intercepted, and obtaining the verification result.

[0027] Step S40: Perform system security protection based on the verification results.

[0028] It should be noted that the system security protection based on the verification result can be determined as an operation that violates system security and is blocked if the similarity of the verification result is greater than a preset similarity threshold; otherwise, the operation command against the target program can be allowed.

[0029] Modern computer hosts are equipped with security software (such as antivirus software and security guards) to protect the system from virus damage and data encryption. With the development of security countermeasures, many hackers now use ARK tools (ARK tools are designed to detect and combat malicious kernel programs such as rootkits, performing security analysis by delving into the system kernel layer. These tools are widely used in the security field to identify and eliminate hidden malware, and are also used to disable the protective capabilities of security software, causing it to fail) to compromise the protective functions of security software, such as forcibly suspending or terminating the security software process or shredding its program files. After compromising the protective functions, they then encrypt data files to achieve their ransomware goals. Therefore, in this embodiment, when the object entity is a newly created service, the characteristic information corresponding to the object entity is obtained, including: Obtain the driver path information corresponding to the newly created service; The driver's characteristic information is determined based on the driver path information.

[0030] It should be noted that obtaining the driver path information corresponding to the newly created service can be achieved by creating a registry callback using CmRegisterCallbackEx (CmRegisterCallbackEx is an API provided by the system kernel, mainly used to register a callback function to monitor access operations to the registry). The driver path information for creating the service can then be obtained within the registry callback function. Determining the driver's characteristic information based on the driver path information can be achieved by obtaining the driver's signature and hash value information based on the driver path information.

[0031] Furthermore, when the object entity is a newly created service, the verification of the feature information corresponding to the object entity can be performed by determining whether the feature information (the driver's signature and hash value) exists in a pre-collected whitelist. If not, the verification result is a verification failure; if it exists in the pre-collected whitelist, the verification result is a verification success. The pre-collected whitelist includes information such as the signatures and hash values ​​of drivers that are predetermined and do not cause damage to the system.

[0032] To avoid false interception, step S40 may include: if it is determined that there is currently a destructive behavior based on the verification result, reporting a prompt message and prompting the user to enter a security verification code; Verify the security verification code entered by the user; If the verification passes, respond to the operation command.

[0033] It should be noted that the prompt information may include the driver's program path, manufacturer information, signature, hash value, etc. The security verification code may be a verification code obtained by the user from a verification code server.

[0034] In practical implementation, for cases where the ARK tool loads drivers, this embodiment restricts driver loading by intercepting the creation of the driver service. Since Windows requires the creation of a corresponding driver service before loading a driver, intercepting service creation allows for restriction of driver loading. When Windows creates a driver service, it writes service-related information, including the driver's path information, into the registry "HKLM\SYSTEM\ControlSet0xx\Services". A registry callback can be created using CmRegisterCallbackEx. The path information of the driver used to create the service is then obtained within the registry callback function. Based on this path information, the program's signature and hash value are obtained. It is then determined whether this information exists in a pre-collected whitelist. If not, the registry write operation is blocked, and the relevant path information is reported to the application.

[0035] The application will display the blocking information to the user in a pop-up window. By default, the system will block the operation. If the user confirms that the driver file is safe, they can use the obtained security verification code to confirm the security of the operation. After successful verification, the operation will be allowed. The specific verification process is as follows: A. After receiving the reported information, the application will display the driver information (including program path, manufacturer information, and signature information) to the user through a dialog box; if the user clicks "Allow Operation," the user will be prompted to enter a verification code. B. After logging into the verification code server and obtaining the security verification code, the user enters the security verification code in the pop-up input box and clicks "confirm". The client will then verify the correctness of the security verification code. C. Once the security verification code is verified, the user confirms that the erroneous interception has been allowed to proceed, the driver has been loaded normally, and the business software can be used normally. D. If the client is remotely operated by malicious personnel, they will also be unable to obtain the security verification code, thus preventing the driver service from being created and the driver from being loaded. When malicious personnel attempt to brute-force the security verification code, after multiple consecutive failed verifications (which can be preset, usually 3 times), the verification will be locked, requiring a preset time to unlock before verification can continue. This effectively limits the loading of the driver, making it difficult for ARK to compromise the security software's protection features without the driver.

[0036] Furthermore, while intercepting service creation can restrict driver loading, it cannot be intercepted if a hacker replaces an existing driver service and then attempts to load it. To protect against this scenario, this embodiment, before obtaining the object entity corresponding to the operation instruction in response to the target program's operation instruction, further includes: Enumerate all driver services on the system and determine the driver files corresponding to all driver services; System security protection is based on the aforementioned driver file.

[0037] It should be noted that the enumeration of driver services on the system can be an enumeration of all existing driver services on the system, obtaining the driver file for each driver service. System security protection based on these driver files can involve monitoring modification activities based on these driver files. Monitoring modification activities can include monitoring write and modification activities of these driver files. If write or modification activities are detected, a pop-up prompt is sent to the application, prompting the user to enter a security verification code. If the user enters the correct security verification code, the activity is allowed; if no verification code is entered within a specified time, the activity is blocked. This prevents malicious personnel from maliciously replacing the drivers of existing driver services while ensuring that normal software upgrades are not affected, thus guaranteeing system security without impacting system operations.

[0038] This embodiment responds to the operation instructions of the target program, obtains the object entity corresponding to the operation instructions, obtains the feature information corresponding to the object entity, verifies the feature information corresponding to the object entity, and performs system security protection based on the verification results. By extracting and verifying the feature information of the object entity involved in the operation instructions, this embodiment can accurately identify potential threats, prevent malicious objects from executing or damaging the system, ensure the normal use of ARK tools and security software, and prevent hackers from using these tools and software to damage the system's security protection software, effectively improving security.

[0039] Based on the above embodiments of this application, in the second embodiment of this application, the same or similar content as the above embodiments can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 2 , Figure 2 This is a flowchart illustrating a second embodiment of the system security protection method of this application. When the object entity is interacting with a driver, the system security protection method includes: Step S201': Obtain communication interaction data between the security software and the driver; It should be noted that the security software can be security software installed on the system. The communication interaction data can be the communication content between the security software and the driver.

[0040] Among these steps, obtaining the communication interaction data between the security software and the driver may involve: determining the device object name of the security software; Determine whether the device object exists in the system based on the device object name; If it exists, a new listening device object is attached to the device object to intercept the communication data between the security software and the driver.

[0041] It's important to note that a Device Object is a core data structure in Windows kernel driver programming, used to represent a physical or logical device. It's an instance of a Windows kernel object, created and managed by the driver, used for communication with user-mode applications or other kernel components. Communication between applications and drivers can be captured by creating new device objects and attaching them to the existing ones. Determining the existence of a device object in the system based on its name can be achieved by periodically enumerating the device objects of security software based on their names. Attaching a new monitoring device object to the existing one to intercept communication can be done by creating a new device object and attaching it to each enumerated device object. This allows the communication between these security software programs and their drivers to be intercepted within the driver's IOCTL callback function (e.g., IRP_MJ_DEVICE_CONTROL). IOCTL callback functions are dispatch functions in drivers specifically designed to handle IRP requests of type IRP_MJ_DEVICE_CONTROL. They are responsible for receiving IOCTL requests from user space (or other drivers), parsing the control codes (IOCTL Code) and input / output buffer data, and executing the corresponding logic according to different control commands.

[0042] In this implementation, the device object names of the security software in the system are pre-collected. Then, the existence of these device objects in the system is periodically enumerated. If they exist, a new device object is created and attached to it (a new device object is created and attached to each enumerated device object). This allows the communication content between the security software and its drivers to be intercepted in the driver's IOCTL callback function (such as IRP_MJ_DEVICE_CONTROL). The communication protocol between them is analyzed, and an attempt is made to parse the protocol content to determine if there are behaviors such as terminating processes, shredding files, or deleting registry entries. If such behaviors exist, the operation objects of these behaviors are obtained, and it is determined whether these objects belong to the security software itself. If so, the operation is blocked, and access is denied; otherwise, the operation is allowed.

[0043] Step S202': Parse the communication interaction data to obtain the operation object; It should be noted that parsing the communication interaction data can involve parsing the protocol content in the communication interaction data and determining whether there are behaviors such as terminating processes, shredding files, or deleting registry entries. If such behaviors exist, the corresponding operation object is determined.

[0044] Step S203': Perform system security protection based on the operation object.

[0045] It should be noted that system security protection based on the operation object can be achieved by determining whether the operation object belongs to the security software itself. If it does, the operation is blocked and access is denied; otherwise, the operation corresponding to the operation object is allowed.

[0046] This embodiment acquires communication interaction data between the security software and the driver; parses the communication interaction data to obtain the operation object; and performs system security protection based on the operation object. The above method in this embodiment can ensure the normal use of other security software functions while further ensuring that the security software itself is not damaged.

[0047] Based on the above embodiments of this application, in the third embodiment of this application, the same or similar content as the above embodiments can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 3 , Figure 3 This is a flowchart illustrating an embodiment of the system security protection method of this application. When the object entity is a child process being created, step S20 further includes: Step S201: Obtain the program file path information of the child process; It should be noted that when the object entity is a child process, the target program is security software. The security software's functions of terminating processes, shredding files, and deleting registry entries are all integrated into a dedicated executable program. In this case, restricting the execution of this program can also ensure that the security software itself is not compromised.

[0048] Step S202: Determine the characteristic information of the subprocess based on the program file path information.

[0049] It should be noted that the feature information may include process ID, hash value, import table function, and executable file attributes, etc.

[0050] Furthermore, when the object entity is a child process, the verification of the feature information corresponding to the object entity includes: The feature information is compared with the program feature information of a preset malicious program to obtain the comparison result; The verification result of the subprocess is determined based on the comparison results.

[0051] It should be noted that the security software's processes termination, file shredding, and registry deletion functions are all integrated into a dedicated executable program. The program characteristic information of the preset malicious program can be the characteristic information of this executable program, which may include hash values, import table functions, code segment data, executable file attributes (company name, version number, product name, copyright, etc.). The comparison of the characteristic information with the program characteristic information of the preset malicious program yields a comparison result, which can be obtained by comparing the hash values, import table functions, and executable file attributes of the characteristic information. The verification result of the subprocess is determined based on the comparison result. If the similarity between the subprocess's characteristic information and the preset malicious program's characteristic information is greater than a preset threshold, the subprocess is determined to be a restricted program, and the verification result is verification failure.

[0052] In practice, the security software's functions of terminating processes, shredding files, and deleting registry entries are all integrated into a dedicated executable program. In this case, the security software itself can be protected from damage by restricting the execution of this program. The specific implementation method is as follows: A. Collect characteristic information of these programs in advance, including hash values, import table functions, code segment data, executable file attributes (company name, version number, product name, copyright, etc.).

[0053] B. The kernel module monitors the startup of new processes (the child processes), obtains the executable file information of the new processes, and reports it to the application for analysis. For example, a process creation callback can be registered through the PsSetCreateProcessNotifyRoutine system function. Whenever a new process is created, the callback function will be called. Within the callback function, information such as the process ID and program path of the new process can be obtained, and this information is then reported to the application.

[0054] C. After receiving the reported information, the application obtains the program's characteristic information based on the path information. It then compares this information with pre-collected characteristic information to determine if it is the program or a variant listed. The comparison result is then returned to the kernel module. Specifically, the comparison method is as follows: First, the hash values ​​of the programs are compared. If the hash values ​​match, the program is considered a restricted program, and the comparison result is returned directly. Next, the import table functions are compared. If the similarity of the import table functions reaches a certain range (e.g., 70%), the program is also considered a restricted program, and the comparison result is returned directly. Then, the executable file attributes are compared. If the file attribute information similarity reaches a certain range (e.g., 60%), the program is also considered a restricted program, and the comparison result is returned directly. Finally, the code data is compared. If the similarity of the code segment data reaches a certain range (e.g., 80%), the program is also considered a restricted program, and the comparison result is returned.

[0055] D. Based on feedback from the application, the underlying module tracks the process of a pre-collected program using a file filter driver. When the program opens a file, its operation is blocked (this blocking is safe as it doesn't need to hold a global operating system lock; blocking with such a lock would cause system crashes and service interruptions). The module then reports this to the application again, displaying a user interface message indicating the program is high-risk and could damage the system, asking if the user wants it allowed to continue. If the user wants to allow the program to continue, a verification code is required. If the verification code is not entered within the specified time, the process terminates by default to prevent damage to the security software. This method allows for conditional permission to run such programs, ensuring administrators can use these tools while protecting the security software's protective functions.

[0056] This embodiment compares the feature information corresponding to the object entity with the program feature information of a preset malicious program, thereby accurately identifying the malicious executable program and achieving the purpose of protecting the system.

[0057] Based on the above embodiments of this application, in the fourth embodiment of this application, the content that is the same as or similar to the above embodiments can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 4 , Figure 4 This is a flowchart illustrating Embodiment 4 of the system security protection method of this application. When the target program is security software and the object entity is a driver, this embodiment further includes the following steps: Step S201'': Obtain the driver information corresponding to the security software; It should be noted that the driver information may include the driver name of the security software.

[0058] Step S202'': Based on the driver information, determine whether the security software contains system functions that compromise the system's protection functions; It should be noted that the system function that determines whether the security software has the function of damaging the system protection based on the driver information can be to periodically enumerate all the drivers loaded in the system, analyze the import table functions of these drivers, and determine whether there are any system functions that call the function of damaging the security software protection.

[0059] Step S203'': If the security software contains a system function that compromises the system's protection function, determine the operation object corresponding to the system function, and the operation object is the feature information.

[0060] It should be noted that determining the operation object corresponding to the system function can be achieved by obtaining information about the operation object in the callback function of the hook through IAT Hook technology, such as the deleted file name, the terminated process name, and the deleted registry path. Specifically, IAT Hook technology redirects function calls by modifying the Import Address Table (IAT) of the executable file, thereby enabling the monitoring or replacement of specific API functions. Hook, also known as a hook technique, is a mechanism used to monitor or modify the behavior of system and application programs.

[0061] In this implementation, the driver names of these software programs are pre-collected. Then, all loaded drivers in the system are periodically enumerated, and their import table functions are analyzed. If any of these functions call system functions that compromise the security software's protection (e.g., ZwTerminateProcess, ZwSetInformationFile, ZwSetValueKey, etc.), an IAT hook is performed. In the hook's callback function, information about the operation object is obtained (process name, file path, registry path, etc., can be obtained through ObReferenceObjectByHandle, ObQueryNameString, etc.), such as the deleted file name, terminated process name, and deleted registry path. It is then determined whether these operation objects belong to the security software. If so, access is denied; otherwise, the operation is allowed. This method ensures both the normal operation of other security software functions and the protection of the security software itself.

[0062] In this embodiment, when the target program is security software and the object entity is a driver, the driver information corresponding to the security software is obtained; based on the driver information, it is determined whether the security software contains system functions that violate system protection functions; if the security software contains system functions that violate system protection functions, the operation object corresponding to the system function is determined, and the operation object is the feature information. This embodiment, through the above method, can ensure the normal use of other security software functions while ensuring that this security software is not damaged.

[0063] As described above, this embodiment protects the security software from being damaged by ARK tools by intercepting the creation of driver services and monitoring modifications to existing driver files, thereby limiting the operation of ARK-type tools. It also protects the security software from being damaged by other security software by employing IAT Hook technology, creating device objects and attaching them to the device object stack, and identifying and restricting the operation of security software tools. This approach maximizes the compatibility of the business system environment while ensuring the effectiveness of the security software is not compromised.

[0064] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the system security protection method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0065] This application also provides a system security protection device; please refer to... Figure 5 The system safety protection device includes: Response module 10 is used to respond to the operation instructions of the target program and obtain the object entity corresponding to the operation instructions. The object entity includes a newly created service, a child process, and / or communication and interaction with the driver. The acquisition module 20 is used to acquire the feature information corresponding to the object entity; Verification module 30 is used to verify the feature information corresponding to the object entity; System security protection module 40 is used to perform system security protection based on verification results.

[0066] This embodiment responds to the operation instructions of the target program, obtains the object entity corresponding to the operation instructions, obtains the feature information corresponding to the object entity, verifies the feature information corresponding to the object entity, and performs system security protection based on the verification results. By extracting and verifying the feature information of the object entities involved in the operation instructions, this embodiment can accurately identify potential threats, prevent malicious objects from executing or damaging the system, ensure the normal operation of anti-kernel tools (Anti Rootkits, ARKs) and security software, and prevent hackers from using these tools and software to damage the system's security protection software, effectively improving security.

[0067] The system security protection device provided in this application, employing the system security protection method described in the above embodiments, can solve the technical problem of how to improve the system's defense capabilities against various threats. Compared with the prior art, the beneficial effects of the system security protection device provided in this application are the same as those of the system security protection method described in the above embodiments, and other technical features in the system security protection device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0068] This application provides a system security protection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the system security protection method in the above embodiment 1.

[0069] The following is for reference. Figure 6 This document illustrates a structural schematic diagram of a system security protection device suitable for implementing embodiments of this application. The system security protection device in the embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 6 The system security protection device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0070] like Figure 6As shown, the system security protection device may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the system security protection device. The processing device 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the system security protection device to communicate wirelessly or wiredly with other devices to exchange data. Although the figure shows a system security protection device with various systems, it should be understood that it is not required to implement or possess all the systems shown. More or fewer systems may be implemented alternatively.

[0071] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0072] The system security protection device provided in this application, employing the system security protection method described in the above embodiments, can solve the technical problem of how to improve the system's defense capabilities against various threats. Compared with the prior art, the beneficial effects of the system security protection device provided in this application are the same as those of the system security protection method described in the above embodiments, and other technical features of this system security protection device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0073] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0074] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0075] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, which are used to execute the system security protection method described in the above embodiments.

[0076] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0077] The aforementioned computer-readable storage medium may be included in the system security protection device; or it may exist independently and not be assembled into the system security protection device.

[0078] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include object-oriented programming languages—such as Python, Java, Smalltalk, and C++—and conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0079] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0080] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0081] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., computer programs) for executing the above-described system security protection method, thereby solving the technical problem of how to improve the system's defense capabilities against various threats. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the system security protection method provided in the above embodiments, and will not be repeated here.

[0082] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the system security protection method described above.

[0083] The computer program product provided in this application can solve the technical problem of how to improve the system's defense capabilities against various threats. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the system security protection method provided in the above embodiments, and will not be repeated here.

[0084] The above description is only a part of the embodiments of this application and does not limit the scope of protection of this application. All equivalent structural transformations made under the technical concept of this application and using the content of this application specification and drawings, or direct / indirect applications in other related technical fields, are included in the scope of protection of this application.

Claims

1. A system security protection method, characterized in that, The system security protection method includes the following steps: In response to the operation instructions of the target program, the object entity corresponding to the operation instructions is obtained, and the object entity includes the operation object that communicates and interacts with the driver program. Obtain the feature information corresponding to the object entity; Verify the feature information corresponding to the object entity; System security protection is based on verification results; When the object entity is an operation object that communicates and interacts with the driver, the system security protection method includes: The communication interaction data between the security software and the driver is obtained by listening to the device object attached to the device object of the security software; The communication interaction data is parsed to determine whether there are any actions such as terminating processes, shredding files, and / or deleting registry entries. If so, the corresponding operation object is obtained. Determine whether the operation object belongs to the operation object of the security software itself. If the operation object belongs to the operation object of the security software itself, then the operation is blocked and access is denied; otherwise, the operation corresponding to the operation object is allowed.

2. The system security protection method as described in claim 1, characterized in that, When the object entity is a newly created service, obtaining the feature information corresponding to the object entity includes: Obtain the driver path information corresponding to the newly created service; The driver's characteristic information is determined based on the driver path information.

3. The system security protection method as described in claim 1, characterized in that, When the object entity is a child process, obtaining the feature information corresponding to the object entity includes: Obtain the program file path information of the child process; The characteristic information of the subprocess is determined based on the program file path information.

4. The system security protection method as described in claim 3, characterized in that, The verification of the feature information corresponding to the object entity includes: The feature information is compared with the program feature information of a preset malicious program to obtain the comparison result; The verification result of the subprocess is determined based on the comparison results.

5. The system security protection method as described in claim 1, characterized in that, Before obtaining the object entity corresponding to the operation instruction in response to the operation instruction of the target program, the method further includes: Enumerate all driver services on the system and determine the driver files corresponding to all driver services; System security protection is based on the aforementioned driver file.

6. The system security protection method as described in claim 1, characterized in that, Before acquiring the communication interaction data between the security software and the driver, the method further includes: Determine the device object name for the security software; Determine whether the device object exists in the system based on the device object name; If it exists, a new listening device object is attached to the device object to intercept the communication data between the security software and the driver.

7. The system security protection method according to any one of claims 1-4, characterized in that, The steps for system security protection based on verification results include: If, based on the verification results, it is determined that there is currently a destructive act, a prompt message is sent, prompting the user to enter a security verification code; Verify the security verification code entered by the user; If the verification passes, respond to the operation command.

8. A system safety protection device, characterized in that, The system security protection device includes: The response module is used to respond to the operation instructions of the target program and obtain the object entity corresponding to the operation instructions. The object entity includes the operation object that communicates and interacts with the driver program. The acquisition module is used to acquire the feature information corresponding to the object entity; The verification module is used to verify the feature information corresponding to the object entity; The system security protection module is used to perform system security protection based on the verification results; In the case where the object entity is an operation object that communicates and interacts with the driver, the system security protection device is further configured to: obtain the communication interaction data between the security software and the driver through a listening device object attached to the device object of the security software; The communication interaction data is parsed to determine whether there are any actions such as terminating processes, shredding files, and / or deleting registry entries. If so, the corresponding operation object is obtained. Determine whether the operation object belongs to the operation object of the security software itself. If the operation object belongs to the operation object of the security software itself, then the operation is blocked and access is denied; otherwise, the operation corresponding to the operation object is allowed.

9. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the system security protection method as described in any one of claims 1 to 7.

Images