Process detection method and device, computer device, storage medium and product
By detecting processes in the operating system and device kernel and identifying hidden processes by exploiting process differences, the problem of malicious tools hiding in network attack and defense is solved, thereby improving the security and stability of the device.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- SHANGHAI DOUXIANG INFORMATION TECH CO LTD
- Filing Date
- 2026-04-24
- Publication Date
- 2026-06-23
AI Technical Summary
In network attack and defense, attackers can implant malicious tools to hide their own running processes, making it difficult for existing technologies to detect them accurately and affecting the operational security of devices.
The system performs initial process detection on the operating system and device kernel of the device under test, obtains user-mode and kernel-mode processes, identifies hidden processes by utilizing process differences, and generates alarm reports to be sent to the security operations platform.
It enables accurate identification of hidden processes, improves the operational security of the device, and prevents hidden malicious processes from affecting the continuous and stable operation of the device.
Smart Images
Figure CN122268657A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network security technology, and in particular to a process detection method, apparatus, computer equipment, storage medium, and product. Background Technology
[0002] In network attack and defense, after attackers infiltrate data communication devices (such as routers), they often implant malicious tools to maintain persistent control; these malicious tools will hide their running processes to avoid being discovered by administrators.
[0003] Therefore, the accuracy of detecting hidden processes is low, making it impossible to detect hidden processes in a timely manner and affecting the operational security of the device. Summary of the Invention
[0004] Therefore, it is necessary to provide a process detection method, device, computer equipment, storage medium, and product that can promptly detect hidden processes to address the aforementioned technical problems.
[0005] Firstly, this application provides a process detection method. The method includes:
[0006] Perform initial process detection on the operating system of the device to be tested to obtain at least one first user-mode process recorded in the operating system;
[0007] Initial process detection is performed on the device kernel of the device to be detected to obtain at least one first kernel-state process recorded in the device kernel;
[0008] Based on the process differences between each of the first user-mode processes and each of the first kernel-mode processes, process detection is performed on the device under test to obtain the hidden processes contained in the device under test.
[0009] In one embodiment, the step of performing process detection on the device under test based on the process differences between each of the first user-mode processes and each of the first kernel-mode processes to obtain the hidden processes contained in the device under test includes:
[0010] For each first kernel-mode process, verify whether there is a user-mode process in each first user-mode process that is the same as the first kernel-mode process;
[0011] If it does not exist, the first kernel-mode process is used as a candidate process, and the hidden process contained in the device to be detected is determined based on the candidate process.
[0012] In one embodiment, determining the hidden process contained in the device to be detected based on the candidate processes includes:
[0013] Perform secondary process detection on the operating system to obtain at least one second user-mode process recorded in the operating system;
[0014] Perform secondary process detection on the device kernel to obtain at least one second kernel-state process recorded in the device kernel;
[0015] If there is no user-mode process identical to the candidate process in each of the second user-mode processes, and there is a kernel-mode process identical to the candidate process in each of the second kernel-mode processes, then the candidate process is considered a hidden process contained in the device to be detected.
[0016] In one embodiment, the initial process detection of the device kernel of the device to be detected, to obtain at least one first kernel-state process recorded in the device kernel, includes:
[0017] Based on the process descriptor information of the core data structure in the device kernel, at least one first kernel-state subprocess recorded in the device kernel is determined;
[0018] Based on the list of tasks waiting for processor scheduling in the device kernel, determine at least one second kernel-state child process recorded in the device kernel;
[0019] The first kernel-state subprocesses and the second kernel-state subprocesses are aggregated to obtain at least one first kernel-state process recorded in the device kernel.
[0020] In one embodiment, the initial process detection of the operating system of the device to be detected to obtain at least one first user-mode process recorded in the operating system includes:
[0021] Based on a pre-defined detection agent process, the system interface of the operating system is used to perform initial process detection on the operating system to obtain at least one first user-mode process recorded in the operating system.
[0022] In one embodiment, the method further includes:
[0023] Obtain process-related information of the hidden process;
[0024] Based on the process-related information, generate an alarm report for the hidden process;
[0025] The alarm report is sent to the security operations platform so that the security operations platform can process the hidden process based on the alarm report.
[0026] Secondly, this application also provides a process detection device. The device includes:
[0027] The first detection module is used to perform initial process detection on the operating system of the device to be tested, and to obtain at least one first user-mode process recorded in the operating system.
[0028] The second detection module is used to perform initial process detection on the device kernel of the device to be detected, and obtain at least one first kernel state process recorded in the device kernel;
[0029] The third detection module is used to perform process detection on the device under test based on the process differences between each of the first user-mode processes and each of the first kernel-mode processes, so as to obtain the hidden processes contained in the device under test.
[0030] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:
[0031] Perform initial process detection on the operating system of the device to be tested to obtain at least one first user-mode process recorded in the operating system;
[0032] Initial process detection is performed on the device kernel of the device to be detected to obtain at least one first kernel-state process recorded in the device kernel;
[0033] Based on the process differences between each of the first user-mode processes and each of the first kernel-mode processes, process detection is performed on the device under test to obtain the hidden processes contained in the device under test.
[0034] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:
[0035] Perform initial process detection on the operating system of the device to be tested to obtain at least one first user-mode process recorded in the operating system;
[0036] Initial process detection is performed on the device kernel of the device to be detected to obtain at least one first kernel-state process recorded in the device kernel;
[0037] Based on the process differences between each of the first user-mode processes and each of the first kernel-mode processes, process detection is performed on the device under test to obtain the hidden processes contained in the device under test.
[0038] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps:
[0039] Perform initial process detection on the operating system of the device to be tested to obtain at least one first user-mode process recorded in the operating system;
[0040] Initial process detection is performed on the device kernel of the device to be detected to obtain at least one first kernel-state process recorded in the device kernel;
[0041] Based on the process differences between each of the first user-mode processes and each of the first kernel-mode processes, process detection is performed on the device under test to obtain the hidden processes contained in the device under test.
[0042] The aforementioned process detection method, apparatus, computer equipment, storage medium, and product perform initial process detection on the operating system of the device under test to obtain at least one first user-mode process recorded in the operating system; and perform initial process detection on the device kernel of the device under test to obtain at least one first kernel-mode process recorded in the device kernel. This enables process detection of the device under test based on the process differences between the first user-mode processes and the first kernel-mode processes, thereby identifying hidden processes contained in the device under test. As can be seen from the above, this application performs initial process detection on both the operating system and the device kernel of the device under test to obtain each first user-mode process and each first kernel-mode process. Since the first user-mode processes are those that can be queried by the user, while the first kernel-mode processes are those actually contained in the device under test, the process differences between the first user-mode processes and the first kernel-mode processes allow for the determination of whether the device under test contains such processes. This achieves accurate identification of hidden processes, improves the operational security of the device under test, and prevents hidden malicious processes from affecting the continuous and stable operation of the device. Attached Figure Description
[0043] Figure 1 This application provides an illustration of the application environment for a process detection method.
[0044] Figure 2 A flowchart illustrating the first process detection method provided in this application embodiment;
[0045] Figure 3 A flowchart illustrating the second process detection method provided in this application embodiment;
[0046] Figure 4 A flowchart illustrating the third process detection method provided in this application embodiment;
[0047] Figure 5 A flowchart illustrating the fourth process detection method provided in this application embodiment;
[0048] Figure 6 A flowchart illustrating the fifth process detection method provided in this application embodiment;
[0049] Figure 7 A structural block diagram of a process detection device provided in an embodiment of this application;
[0050] Figure 8 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation
[0051] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.
[0052] The process detection method provided in this application embodiment can be applied to, for example, Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or placed on a cloud or other network server. Initial process detection is performed on the operating system of the device under test to obtain at least one first user-mode process recorded in the operating system; initial process detection is performed on the device kernel of the device under test to obtain at least one first kernel-mode process recorded in the device kernel; based on the process differences between each first user-mode process and each first kernel-mode process, process detection is performed on the device under test to obtain the hidden processes contained in the device under test. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can be smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, etc. Portable wearable devices can be smartwatches, smart bracelets, head-mounted devices, etc. Server 104 can be implemented using a standalone server or a server cluster composed of multiple servers.
[0053] In one embodiment, such as Figure 2 As shown, a process detection method is provided, which can be applied to... Figure 1 Taking server 104 as an example, the following steps are included:
[0054] S201, Perform initial process detection on the operating system of the device to be tested, and obtain at least one first user-mode process recorded in the operating system.
[0055] Among them, the first user-mode process refers to the process in the operating system that can be detected by the user.
[0056] It should be noted that when it is necessary to perform initial process detection on the operating system of the device to be tested, a detection agent process can be pre-deployed. Then, based on the detection agent process, the initial process detection of the operating system of the device to be tested can be performed to obtain at least one first user-mode process recorded in the operating system.
[0057] Specifically, based on a pre-defined detection agent process, the system interface of the operating system is used to perform initial process detection on the operating system to obtain at least one first user-mode process recorded in the operating system.
[0058] In one embodiment of this application, when initial process detection of the operating system of the device to be tested is required, the following may be included: deploying and starting a detection agent process on the device to be tested. This agent process requests and obtains the current system's process list through a standard operating system interface. Specific operations may include, but are not limited to: traversing the numeric directories under the / proc pseudo-filesystem, calling the sys_getdents system call, and executing the ps command and parsing the output. Furthermore, the obtained process information (PID, process name, PPID, etc.) is stored as at least one first user-space process.
[0059] S202, Perform initial process detection on the device kernel of the device to be detected, and obtain at least one first kernel-mode process recorded in the device kernel.
[0060] It should be noted that when it is necessary to perform initial process detection on the device kernel of the device to be tested, process query can be performed on the memory space of the device kernel to read the process descriptor information (PID, process name, status) in the memory structure; thereby, the purpose of obtaining at least one first kernel state process recorded in the device kernel can be achieved.
[0061] S203, perform process detection on the device to be detected based on the process differences between each first user-mode process and each first kernel-mode process, and obtain the hidden processes contained in the device to be detected.
[0062] It should be noted that, in order to ensure that the hidden processes contained in the device under test can be successfully obtained, each first user-mode process and each first kernel-mode process can be compared in advance to determine whether a hidden process exists.
[0063] In one embodiment of this application, when it is necessary to perform process detection on the device to be detected based on the process differences between each first user-mode process and each first kernel-mode process to obtain the hidden processes contained in the device to be detected, the following steps may be included: determining whether each first kernel-mode process is the same as a certain first user-mode process among the first user-mode processes; if a certain first kernel-mode process is the same as a certain first user-mode process, then determining that the first kernel-mode process is not a hidden process; if there is no user-mode process among the first user-mode processes that is the same as a certain first kernel-mode process, then determining that the first kernel-mode process may belong to the hidden processes contained in the device to be detected; and then, performing noise reduction processing on the first kernel-mode process to realize the determination of whether the first kernel-mode process is a hidden process contained in the device to be detected.
[0064] The aforementioned process detection method performs initial process detection on the operating system of the device under test to obtain at least one first user-mode process recorded in the operating system; it also performs initial process detection on the device kernel of the device under test to obtain at least one first kernel-mode process recorded in the device kernel; and it detects hidden processes contained in the device under test based on the process differences between the first user-mode processes and the first kernel-mode processes. As can be seen from the above, this application performs initial process detection on both the operating system and the device kernel of the device under test to obtain each first user-mode process and each first kernel-mode process. Since the first user-mode processes are those that can be queried by the user, while the first kernel-mode processes are those actually contained in the device under test, the method can determine whether the device under test contains such processes based on the process differences between them. This achieves accurate identification of hidden processes, improves the operational security of the device under test, and prevents hidden malicious processes from affecting the continuous and stable operation of the device.
[0065] In one embodiment, such as Figure 3 As shown, when it is necessary to perform process detection on the device to be detected based on the process differences between each first user-mode process and each first kernel-mode process, and to obtain the hidden processes contained in the device to be detected, the following can be included:
[0066] S301, for each first kernel-mode process, verify whether there is a user-mode process in each first user-mode process that is the same as the first kernel-mode process.
[0067] It should be noted that each first user-mode process and each first kernel-mode process can be transmitted to a pre-set analysis engine for process comparison, or the process comparison can be performed in the kernel mode of the device under test, so as to verify whether there is a user-mode process in each first user-mode process that is the same as the first kernel-mode process for each first kernel-mode process.
[0068] In one embodiment of this application, differential operations can be used to verify whether there is a user-mode process identical to the first kernel-mode process in each first user-mode process; specifically, the differential operation process is as follows:
[0069] Diff =View_Kernel-View_User;
[0070] Where Diff represents a first kernel-mode process (candidate process) that is different from each first user-mode process; View_Kernel represents each first kernel-mode process; and View_User represents each first user-mode process.
[0071] S302 If it does not exist, the first kernel-mode process is taken as a candidate process, and the hidden process contained in the device to be detected is determined based on the candidate process.
[0072] It should be noted that, since the system operation of the device under test is dynamic, there may be short-lived processes being created or destroyed within the tiny time difference between acquiring each first user-mode process and each first kernel-mode process. Therefore, multiple sampling verification operations can be achieved through noise reduction processing.
[0073] Specifically, when it is necessary to determine the hidden processes contained in the device to be detected based on the candidate processes, the following may be included: performing secondary process detection on the operating system to obtain at least one second user-mode process recorded in the operating system; performing secondary process detection on the device kernel to obtain at least one second kernel-mode process recorded in the device kernel; if there is no user-mode process identical to the candidate process among the second user-mode processes, and there is a kernel-mode process identical to the candidate process among the second kernel-mode processes, then the candidate process is regarded as the hidden process contained in the device to be detected.
[0074] Specifically, the time interval between the initial process detection of the operating system of the device under test and the secondary process detection of the operating system is greater than a preset time interval; and the time interval between the initial process detection of the device kernel of the device under test and the secondary process detection of the device kernel is greater than a preset time interval.
[0075] In one embodiment of this application, after determining the candidate process, a second process detection is performed on the operating system after an interval of T (e.g., 100ms) to obtain at least one second user-mode process recorded in the operating system; a second process detection is performed on the device kernel to obtain at least one second kernel-mode process recorded in the device kernel; if the candidate process exists in each second kernel-mode process but is missing in each second user-mode process, it is determined to be a "hidden process".
[0076] The above process detection method verifies whether there is a user-mode process that is the same as the first kernel-mode process in each first user-mode process, thereby determining whether the device under test contains such a process. This achieves accurate identification of hidden processes, improves the operational security of the device under test, and prevents hidden malicious processes from affecting the continuous and stable operation of the device.
[0077] In one embodiment, such as Figure 4 As shown, when it is necessary to perform initial process detection on the device kernel of the device to be detected and obtain at least one first kernel-mode process recorded in the device kernel, the following may be included:
[0078] S401, based on the process descriptor information of the core data structure in the device kernel, determine at least one first kernel-mode child process recorded in the device kernel.
[0079] In one embodiment of this application, when it is necessary to obtain process descriptor information of core data structures in the device kernel to obtain each first kernel-state child process, the following may be included: A lightweight kernel module (LKM) is loaded into the device kernel of the device to be detected, and this module has direct access permissions to the kernel memory space. Within the device kernel space, the file system layer is bypassed, and the core data structures used by the device kernel to manage processes are directly accessed. (For example, for Linux systems, by locating the init_task symbol, the doubly linked list of task_struct in the kernel is directly traversed using the list_for_each macro). During the traversal, the process descriptor information (PID, process name, state) in the memory structure is directly read to determine at least one first kernel-state child process recorded in the device kernel.
[0080] S402, based on the list of tasks waiting for processor scheduling in the device kernel, determine at least one second kernel-mode child process recorded in the device kernel.
[0081] It should be noted that, in order to prevent the linked list from being broken due to DKOM (Direct Kernel Object Operation) attacks, which would prevent some processes waiting for processor calls from being obtained, at least one second kernel-state child process recorded in the device kernel can be determined based on the list of tasks waiting for processor scheduling in the device kernel.
[0082] Each of the second kernel-mode child processes is a process waiting to be called by the processor.
[0083] In one embodiment of this application, the kernel's scheduling queue (Runqueue) or waiting queue is scanned to obtain a list of tasks waiting for processor scheduling in the device kernel.
[0084] S403, summarize each first kernel-state subprocess and each second kernel-state subprocess to obtain at least one first kernel-state process recorded in the device kernel.
[0085] Each first kernel state process contains each first kernel state subprocess and each second kernel state subprocess.
[0086] In one embodiment of this application, processes that exist in each second kernel-state subprocess but not in each first kernel-state subprocess are determined to be "off-chain hidden processes (DKOM attack)".
[0087] The aforementioned process detection method uses process descriptor information from core data structures in the device kernel, as well as a list of tasks waiting for processor scheduling in the device kernel, to obtain each first kernel-mode subprocess and each second kernel-mode subprocess. It then aggregates these first and second kernel-mode subprocesses to obtain at least one first kernel-mode process recorded in the device kernel. This provides a data foundation for subsequently determining the process differences between each first user-mode process and each first kernel-mode process, ensuring the smooth execution of subsequent processes.
[0088] In one embodiment, such as Figure 5 As shown, after identifying the hidden process, the following may also be included:
[0089] S501, retrieve process-related information of the hidden process.
[0090] The process-related information may include, but is not limited to: the memory address of the hidden process, the parent process information of the hidden process, and the module information loaded by the hidden process.
[0091] S502 generates an alarm report for the hidden process based on process-related information.
[0092] It should be noted that the alarm report may also include the alarm priority of hidden processes.
[0093] In one embodiment of this application, the alarm priority of the hidden process can be pre-assessed, and then a report template can be obtained. Then, process-related information and the alarm priority of the hidden process can be filled into the relevant area of the report template to generate an alarm report for the hidden process.
[0094] S503 sends the alarm report to the security operations platform.
[0095] This includes sending alarm reports to the security operations platform so that the platform can handle the hidden processes based on the alarm reports.
[0096] In one embodiment of this application, when a hidden process is processed based on an alarm report, the security operations platform can send a SIGKILL signal directly to the hidden process through the kernel module to force its removal, or freeze its memory pages to block its operation.
[0097] The process detection method described above improves the operational security of the device under test by generating alarm reports for hidden processes and sending the alarm reports to the security operations platform, thereby preventing hidden malicious processes from affecting the continuous and stable operation of the device.
[0098] In one embodiment, such as Figure 6 As shown, when it is necessary to obtain hidden processes contained in the device under test, the following can be included:
[0099] S601, based on a pre-defined detection agent process, performs initial process detection on the operating system through the system interface of the operating system to obtain at least one first user-mode process recorded in the operating system.
[0100] S602, based on the process descriptor information of the core data structure in the device kernel, determine at least one first kernel-mode child process recorded in the device kernel.
[0101] S603, based on the list of tasks waiting for processor scheduling in the device kernel, determine at least one second kernel-mode child process recorded in the device kernel.
[0102] S604, summarize each first kernel-state subprocess and each second kernel-state subprocess to obtain at least one first kernel-state process recorded in the device kernel.
[0103] S605 verifies, for each first kernel-mode process, whether there exists a user-mode process in each first user-mode process that is the same as the first kernel-mode process.
[0104] If S606 does not exist, the first kernel-mode process will be used as the candidate process.
[0105] S607 performs secondary process detection on the operating system to obtain at least one second user-mode process recorded in the operating system.
[0106] S608 performs secondary process detection on the device kernel to obtain at least one second kernel-mode process recorded in the device kernel.
[0107] S609, if there is no user-mode process in each second user-mode process that is the same as the candidate process, and there is a kernel-mode process in each second kernel-mode process that is the same as the candidate process, then the candidate process is regarded as a hidden process contained in the device to be detected.
[0108] The aforementioned process detection method performs initial process detection on the operating system of the device under test to obtain at least one first user-mode process recorded in the operating system; it also performs initial process detection on the device kernel of the device under test to obtain at least one first kernel-mode process recorded in the device kernel; and it detects hidden processes contained in the device under test based on the process differences between the first user-mode processes and the first kernel-mode processes. As can be seen from the above, this application performs initial process detection on both the operating system and the device kernel of the device under test to obtain each first user-mode process and each first kernel-mode process. Since the first user-mode processes are those that can be queried by the user, while the first kernel-mode processes are those actually contained in the device under test, the method can determine whether the device under test contains such processes based on the process differences between them. This achieves accurate identification of hidden processes, improves the operational security of the device under test, and prevents hidden malicious processes from affecting the continuous and stable operation of the device.
[0109] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.
[0110] Based on the same inventive concept, this application also provides a process detection apparatus for implementing the process detection method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more process detection apparatus embodiments provided below can be found in the limitations of the process detection method described above, and will not be repeated here.
[0111] In one embodiment, such as Figure 7As shown, a process detection device is provided, comprising: a first detection module 10, a second detection module 20, and a third detection module 30, wherein:
[0112] The first detection module 10 is used to perform initial process detection on the operating system of the device to be tested, and to obtain at least one first user-mode process recorded in the operating system.
[0113] The second detection module 20 is used to perform initial process detection on the device kernel of the device to be detected, and obtain at least one first kernel state process recorded in the device kernel.
[0114] The third detection module 30 is used to perform process detection on the device to be detected based on the process differences between each first user-mode process and each first kernel-mode process, and to obtain the hidden processes contained in the device to be detected.
[0115] In one embodiment, for each first kernel-mode process, it is verified whether there is a user-mode process in each first user-mode process that is the same as the first kernel-mode process.
[0116] If it does not exist, the first kernel-mode process is selected as a candidate process, and the hidden process contained in the device to be detected is determined based on the candidate process.
[0117] In one embodiment, a second process detection is performed on the operating system to obtain at least one second user-mode process recorded in the operating system;
[0118] Perform secondary process detection on the device kernel to obtain at least one second kernel-mode process recorded in the device kernel;
[0119] If there is no user-mode process identical to the candidate process in each of the second user-mode processes, and there is a kernel-mode process identical to the candidate process in each of the second kernel-mode processes, then the candidate process will be considered as a hidden process contained in the device to be detected.
[0120] In one embodiment, at least one first kernel-mode subprocess recorded in the device kernel is determined based on the process descriptor information of the core data structure in the device kernel.
[0121] Based on the list of tasks waiting for processor scheduling in the device kernel, determine at least one second kernel-state child process recorded in the device kernel;
[0122] By summing up each first kernel-mode subprocess and each second kernel-mode subprocess, at least one first kernel-mode process recorded in the device kernel is obtained.
[0123] In one embodiment, based on a pre-defined detection agent process, the operating system is used to perform initial process detection on the operating system through the system interface of the operating system to obtain at least one first user-mode process recorded in the operating system.
[0124] In one embodiment, process-related information of the hidden process is obtained;
[0125] Based on process-related information, generate alert reports for hidden processes;
[0126] The alarm report is sent to the security operations platform so that the security operations platform can handle the hidden process based on the alarm report.
[0127] The aforementioned process detection device performs initial process detection on the operating system of the device under test to obtain at least one first user-mode process recorded in the operating system; it also performs initial process detection on the device kernel of the device under test to obtain at least one first kernel-mode process recorded in the device kernel; and it performs process detection on the device under test based on the process differences between each first user-mode process and each first kernel-mode process to obtain hidden processes contained in the device under test. As can be seen from the above, this application performs initial process detection on the operating system and the device kernel of the device under test during process detection to obtain each first user-mode process and each first kernel-mode process. Since the first user-mode processes are processes that users can query, while the first kernel-mode processes are processes actually contained in the device under test, the process differences between each first user-mode process and each first kernel-mode process can be used to determine whether the device under test contains such processes. This achieves accurate identification of hidden processes, improves the operational security of the device under test, and prevents hidden malicious processes from affecting the continuous and stable operation of the device.
[0128] Each module in the aforementioned process detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.
[0129] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 8As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a process detection method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.
[0130] Those skilled in the art will understand that Figure 8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.
[0131] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:
[0132] Perform initial process detection on the operating system of the device to be tested to obtain at least one first user-mode process recorded in the operating system;
[0133] Perform initial process detection on the device kernel of the device to be tested to obtain at least one first kernel-mode process recorded in the device kernel;
[0134] Based on the process differences between each first user-mode process and each first kernel-mode process, process detection is performed on the device to be detected to obtain the hidden processes contained in the device to be detected.
[0135] In one embodiment, the processor, when executing a computer program, also performs the following steps:
[0136] For each first kernel-mode process, verify whether there is a user-mode process in each first user-mode process that is the same as the first kernel-mode process.
[0137] If it does not exist, the first kernel-mode process is selected as a candidate process, and the hidden process contained in the device to be detected is determined based on the candidate process.
[0138] In one embodiment, the processor, when executing a computer program, also performs the following steps:
[0139] Perform secondary process detection on the operating system to obtain at least one second user-mode process recorded in the operating system;
[0140] Perform secondary process detection on the device kernel to obtain at least one second kernel-mode process recorded in the device kernel;
[0141] If there is no user-mode process identical to the candidate process in each of the second user-mode processes, and there is a kernel-mode process identical to the candidate process in each of the second kernel-mode processes, then the candidate process will be considered as a hidden process contained in the device to be detected.
[0142] In one embodiment, the processor, when executing a computer program, also performs the following steps:
[0143] Based on the process descriptor information of the core data structures in the device kernel, determine at least one first kernel-mode child process recorded in the device kernel;
[0144] Based on the list of tasks waiting for processor scheduling in the device kernel, determine at least one second kernel-state child process recorded in the device kernel;
[0145] By summing up each first kernel-mode subprocess and each second kernel-mode subprocess, at least one first kernel-mode process recorded in the device kernel is obtained.
[0146] In one embodiment, the processor, when executing a computer program, also performs the following steps:
[0147] Based on a pre-defined detection agent process, the system interface of the operating system is used to perform initial process detection on the operating system, thereby obtaining at least one first user-mode process recorded in the operating system.
[0148] In one embodiment, the processor, when executing a computer program, also performs the following steps:
[0149] Obtain process-related information about hidden processes;
[0150] Based on process-related information, generate alert reports for hidden processes;
[0151] The alarm report is sent to the security operations platform so that the security operations platform can handle the hidden process based on the alarm report.
[0152] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:
[0153] Perform initial process detection on the operating system of the device to be tested to obtain at least one first user-mode process recorded in the operating system;
[0154] Perform initial process detection on the device kernel of the device to be tested to obtain at least one first kernel-mode process recorded in the device kernel;
[0155] Based on the process differences between each first user-mode process and each first kernel-mode process, process detection is performed on the device to be detected to obtain the hidden processes contained in the device to be detected.
[0156] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0157] For each first kernel-mode process, verify whether there is a user-mode process in each first user-mode process that is the same as the first kernel-mode process.
[0158] If it does not exist, the first kernel-mode process is selected as a candidate process, and the hidden process contained in the device to be detected is determined based on the candidate process.
[0159] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0160] Perform secondary process detection on the operating system to obtain at least one second user-mode process recorded in the operating system;
[0161] Perform secondary process detection on the device kernel to obtain at least one second kernel-mode process recorded in the device kernel;
[0162] If there is no user-mode process identical to the candidate process in each of the second user-mode processes, and there is a kernel-mode process identical to the candidate process in each of the second kernel-mode processes, then the candidate process will be considered as a hidden process contained in the device to be detected.
[0163] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0164] Based on the process descriptor information of the core data structures in the device kernel, determine at least one first kernel-mode child process recorded in the device kernel;
[0165] Based on the list of tasks waiting for processor scheduling in the device kernel, determine at least one second kernel-state child process recorded in the device kernel;
[0166] By summing up each first kernel-mode subprocess and each second kernel-mode subprocess, at least one first kernel-mode process recorded in the device kernel is obtained.
[0167] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0168] Based on a pre-defined detection agent process, the system interface of the operating system is used to perform initial process detection on the operating system, thereby obtaining at least one first user-mode process recorded in the operating system.
[0169] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0170] Obtain process-related information about hidden processes;
[0171] Based on process-related information, generate alert reports for hidden processes;
[0172] The alarm report is sent to the security operations platform so that the security operations platform can handle the hidden process based on the alarm report.
[0173] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:
[0174] Perform initial process detection on the operating system of the device to be tested to obtain at least one first user-mode process recorded in the operating system;
[0175] Perform initial process detection on the device kernel of the device to be tested to obtain at least one first kernel-mode process recorded in the device kernel;
[0176] Based on the process differences between each first user-mode process and each first kernel-mode process, process detection is performed on the device to be detected to obtain the hidden processes contained in the device to be detected.
[0177] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0178] For each first kernel-mode process, verify whether there is a user-mode process in each first user-mode process that is the same as the first kernel-mode process.
[0179] If it does not exist, the first kernel-mode process is selected as a candidate process, and the hidden process contained in the device to be detected is determined based on the candidate process.
[0180] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0181] Perform secondary process detection on the operating system to obtain at least one second user-mode process recorded in the operating system;
[0182] Perform secondary process detection on the device kernel to obtain at least one second kernel-mode process recorded in the device kernel;
[0183] If there is no user-mode process identical to the candidate process in each of the second user-mode processes, and there is a kernel-mode process identical to the candidate process in each of the second kernel-mode processes, then the candidate process will be considered as a hidden process contained in the device to be detected.
[0184] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0185] Based on the process descriptor information of the core data structures in the device kernel, determine at least one first kernel-mode child process recorded in the device kernel;
[0186] Based on the list of tasks waiting for processor scheduling in the device kernel, determine at least one second kernel-state child process recorded in the device kernel;
[0187] By summing up each first kernel-mode subprocess and each second kernel-mode subprocess, at least one first kernel-mode process recorded in the device kernel is obtained.
[0188] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0189] Based on a pre-defined detection agent process, the system interface of the operating system is used to perform initial process detection on the operating system, thereby obtaining at least one first user-mode process recorded in the operating system.
[0190] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:
[0191] Obtain process-related information about hidden processes;
[0192] Based on process-related information, generate alert reports for hidden processes;
[0193] The alarm report is sent to the security operations platform so that the security operations platform can handle the hidden process based on the alarm report.
[0194] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.
[0195] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.
[0196] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0197] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.
Claims
1. A process detection method, characterized in that, The method includes: Perform initial process detection on the operating system of the device to be tested to obtain at least one first user-mode process recorded in the operating system; Initial process detection is performed on the device kernel of the device to be detected to obtain at least one first kernel-state process recorded in the device kernel; Based on the process differences between each of the first user-mode processes and each of the first kernel-mode processes, process detection is performed on the device under test to obtain the hidden processes contained in the device under test.
2. The method according to claim 1, characterized in that, The step of performing process detection on the device under test based on the process differences between each of the first user-mode processes and each of the first kernel-mode processes to obtain the hidden processes contained in the device under test includes: For each first kernel-mode process, verify whether there is a user-mode process in each first user-mode process that is the same as the first kernel-mode process; If it does not exist, the first kernel-mode process is used as a candidate process, and the hidden process contained in the device to be detected is determined based on the candidate process.
3. The method according to claim 2, characterized in that, The step of determining the hidden process contained in the device to be detected based on the candidate processes includes: Perform secondary process detection on the operating system to obtain at least one second user-mode process recorded in the operating system; Perform secondary process detection on the device kernel to obtain at least one second kernel-state process recorded in the device kernel; If there is no user-mode process identical to the candidate process in each of the second user-mode processes, and there is a kernel-mode process identical to the candidate process in each of the second kernel-mode processes, then the candidate process is considered a hidden process contained in the device to be detected.
4. The method according to claim 1, characterized in that, The initial process detection of the device kernel of the device to be detected, to obtain at least one first kernel-state process recorded in the device kernel, includes: Based on the process descriptor information of the core data structure in the device kernel, at least one first kernel-state subprocess recorded in the device kernel is determined; Based on the list of tasks waiting for processor scheduling in the device kernel, determine at least one second kernel-state child process recorded in the device kernel; The first kernel-state subprocesses and the second kernel-state subprocesses are aggregated to obtain at least one first kernel-state process recorded in the device kernel.
5. The method according to claim 1, characterized in that, The initial process detection of the operating system of the device under test, to obtain at least one first user-mode process recorded in the operating system, includes: Based on a pre-defined detection agent process, the system interface of the operating system is used to perform initial process detection on the operating system to obtain at least one first user-mode process recorded in the operating system.
6. The method according to claim 1, characterized in that, The method further includes: Obtain process-related information of the hidden process; Based on the process-related information, generate an alarm report for the hidden process; The alarm report is sent to the security operations platform so that the security operations platform can process the hidden process based on the alarm report.
7. A process detection device, characterized in that, The device includes: The first detection module is used to perform initial process detection on the operating system of the device to be tested, and to obtain at least one first user-mode process recorded in the operating system. The second detection module is used to perform initial process detection on the device kernel of the device to be detected, and obtain at least one first kernel state process recorded in the device kernel; The third detection module is used to perform process detection on the device under test based on the process differences between each of the first user-mode processes and each of the first kernel-mode processes, so as to obtain the hidden processes contained in the device under test.
8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.
10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.