Trojan process positioning method and device with minute level, equipment and medium

Abstract

The embodiment of the application provides a kind of minute level Trojan process positioning method, device, equipment and medium, method includes: based on Trojan tampering feature library and preset check rule, the monitoring binary file in the system to be repaired is carried out non-full plate type directional fingerprint check, identify the system monitoring file modified by Trojan process, obtain the standard monitoring file corresponding to system monitoring file, replace system monitoring file with standard monitoring file;Using batch unhide strategy combined with security experience rule to remove the hidden kernel module of Trojan existing in the system to be repaired;Through process information tracing and security experience rule, the high-frequency hiding directory of Trojan in the system to be repaired is carried out non-full plate type directional parallel scanning, and the execution file and start file of Trojan process are positioned in minute level time, and the execution file and start file are deleted from original directory, and user service is temporarily recovered. Efficient positioning and killing Trojan are realized, and the needs of production environment emergency recovery business are fitted.

Description

Technical Field

[0001] This application relates to the field of network security technology, specifically to a method, apparatus, device, and medium for locating minute-level Trojan processes. Background Technology

[0002] Computer systems have become the core infrastructure for modern society's production, life, and economic operation; however, they face increasingly severe and complex challenges from intrusion and malware attacks. Particularly in the data center computing clusters, GPU servers, and computing service leasing sectors, weak user security awareness and limited technical skills lead to issues such as simple passwords, key leaks, and untimely security patch updates. This results in frequent system intrusions, with Trojans illegally occupying computing resources and tampering with system configurations, causing service interruptions and resource waste. Current technologies typically involve a full system scan to remove Trojans, followed by service migration and recovery. This method is time-consuming and cannot meet users' needs for rapid system recovery and continuous business operation. Therefore, existing Trojan location methods are inefficient, leading to low efficiency in Trojan removal and failing to meet the actual needs of rapid response and timely business recovery in production environments. Summary of the Invention

[0003] To address the problems in the existing technology, this application provides a method, apparatus, device, and medium for locating Trojan processes at the minute level, which can effectively improve the efficiency of Trojan location, efficiently detect and kill Trojans, and meet the actual needs of emergency response and timely business recovery in the production environment.

[0004] To solve at least one of the above problems, this application provides the following technical solution: Firstly, this application provides a minute-level Trojan process location method, comprising: constructing a Trojan tampering signature library and a local cache pool of monitoring files; performing non-full-disk targeted fingerprint verification on monitoring binary files in the system to be repaired based on the Trojan tampering signature library and preset verification rules to identify system monitoring files modified by the Trojan process; obtaining a standard monitoring file corresponding to the system monitoring file from the local cache pool of monitoring files; and forcibly replacing the system monitoring file with the standard monitoring file to rebuild a trusted system monitoring environment; confirming the presence of a Trojan hidden kernel module in the system to be repaired based on module anomaly rules and a hidden string library; and using batch... The system employs a quantity-based unhiding strategy combined with security experience rules to remove hidden kernel modules of Trojans present in the system to be repaired, making the Trojan processes visible normally in the system. A non-full-disk, targeted, parallel scan of the high-frequency hiding directories of Trojans in the system to be repaired is performed using process information tracing and the security experience rules. The scan results are then validated for consistency. Within minutes, the executable and startup files of the Trojan processes are located, backed up, migrated to a preset isolation directory, deleted from their original directories, and user services are temporarily restored.

[0005] In some embodiments, the construction of the Trojan tampering signature library and the local cache pool of monitoring files includes: obtaining a set of standard monitoring files from a standard system of the same version as the system to be repaired; for each standard monitoring file in the set of standard monitoring files, extracting the hash fingerprint, file size, file permissions, and file modification time of the standard monitoring file; using the file size, file permissions, and file modification time as file attributes of the standard monitoring file; constructing a first correspondence between the standard monitoring file name, the hash fingerprint, and the file attributes; constructing a second correspondence between the standard monitoring file name and the standard monitoring file; constructing a Trojan tampering signature library based on each of the first correspondences; and constructing a local cache pool of monitoring files based on each of the second correspondences.

[0006] In some embodiments, the step of performing non-full-disk targeted fingerprint verification on monitoring binary files in the system to be repaired based on the Trojan tampering signature library and preset verification rules to identify system monitoring files modified by the Trojan process includes: obtaining a set of monitoring binary files corresponding to the monitoring program in the system to be repaired; calculating the real-time hash fingerprint of each monitoring binary file in the set of monitoring binary files and obtaining the real-time file attributes of the monitoring binary files; obtaining the hash fingerprint and file attributes corresponding to the monitoring binary files from the Trojan tampering signature library; if the hash fingerprint is inconsistent with the real-time hash fingerprint or the real-time file attributes are inconsistent with the file attributes, the monitoring binary files are considered to have failed the signature library verification; executing the monitoring program by calling each verification command in the preset verification rules; if there is an abnormal verification command response, the monitoring binary files are considered to have failed the rule verification, and monitoring binary files that fail the signature library verification or fail the rule verification are identified as system monitoring files modified by the Trojan process.

[0007] In some embodiments, the step of confirming the presence of a Trojan-hidden kernel module in the system to be repaired based on module anomaly rules and a hidden string library includes: determining the set of loaded kernel modules in the system to be repaired; for each kernel module in the set, identifying the kernel module name based on the name anomaly rules in the module anomaly rules to determine whether the kernel module name is abnormal; if abnormal, the kernel module is considered to be a Trojan-hidden kernel module, and the system to be repaired contains a Trojan-hidden kernel module; identifying the process names and process paths in the system to be repaired based on the hidden string library to determine whether there are abnormal process names or abnormal process paths associated with the kernel module; if so, the kernel module is considered to be a Trojan-hidden kernel module; obtaining the visible process resource quantity and the actual load quantity of the system to be repaired; if the difference between the actual load quantity and the visible process resource quantity is greater than a preset load difference value in the module anomaly rules, the system to be repaired is considered to contain a Trojan-hidden kernel module.

[0008] In some embodiments, the step of using a batch unhiding strategy combined with security experience rules to remove Trojan-hidden kernel modules from the system to be repaired includes: sending a batch unhiding instruction from the batch unhiding strategy to the system to be repaired, treating newly displayed kernel modules after the batch unhiding instruction is sent as Trojan-hidden kernel modules; adding the Trojan-hidden kernel modules to the system module blacklist to prevent them from being automatically loaded again; simultaneously uninstalling the Trojan-hidden kernel modules from the system to be repaired using a kernel uninstallation instruction from the security experience rules, and repairing the system process enumeration mechanism that has been tampered with by the Trojan.

[0009] In some embodiments, the step of performing a non-full-disk targeted parallel scan of the high-frequency Trojan hiding directory in the system to be repaired using process information tracing and the security experience rules, and performing consistency verification on the scan results to locate the executable file and startup file of the Trojan process within a minute, includes: finding multiple processes to be verified after the Trojan's hidden kernel module is uninstalled; filtering out Trojan processes with high resource consumption from the multiple processes to be verified; tracing the process information of the Trojan process based on process resource consumption, parent-child process relationship, and network connection characteristics to locate multiple abnormal file paths corresponding to the Trojan process; performing a non-full-disk targeted parallel scan of the high-frequency Trojan hiding directory based on the security experience rules to identify multiple abnormal files with abnormal names, abnormal permissions, and suspicious startup; performing consistency cross-verification between the multiple abnormal file paths and the multiple abnormal files; determining the executable file from the files that are commonly hit and the running file directly corresponding to the Trojan process; and determining the startup file from the files that are commonly hit and the file used to implement the self-starting and persistence of the Trojan program.

[0010] In some embodiments, after temporarily restoring user services, the method further includes: traversing a first set of hash values ​​for all files in the system to be repaired, and calculating a second set of hash values ​​for all files in a standard system of the same version as the system to be repaired; identifying files with abnormal hash values ​​that exist in the first set of hash values ​​but not in the second set of hash values ​​as abnormal files; deleting the abnormal files; and performing security hardening on firewall policies, remote login permissions, and system startup configurations in the system to be repaired.

[0011] Secondly, this application provides a minute-level Trojan process location device, comprising: a construction unit, used to construct a Trojan tampering signature library and a local cache pool of monitoring files, perform non-full-disk targeted fingerprint verification on monitoring binary files in the system to be repaired based on the Trojan tampering signature library and preset verification rules, identify system monitoring files modified by Trojan processes, obtain a standard monitoring file corresponding to the system monitoring file from the local cache pool of monitoring files, and forcibly replace the system monitoring file with the standard monitoring file to rebuild a trusted system monitoring environment; and a confirmation unit, used to confirm the presence of a Trojan hidden kernel module in the system to be repaired based on module anomaly rules and a hidden string library. A batch unhiding strategy combined with security experience rules is used to remove the hidden kernel modules of Trojans in the system to be repaired, making the Trojan processes visible in the system. The locating unit is used to perform a non-full-disk targeted parallel scan of the high-frequency hiding directories of Trojans in the system to be repaired by tracing process information and the security experience rules, and to perform consistency verification on the scan results. Within minutes, the executable file and startup file of the Trojan process are located, the executable file and startup file are backed up, the executable file and startup file are migrated to a preset isolation directory, the executable file and startup file are deleted from the original directory, and user services are temporarily restored.

[0012] Thirdly, this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the minute-level Trojan process location method.

[0013] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the minute-level Trojan process location method described above.

[0014] Fifthly, this application provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the minute-level Trojan process location method described above.

[0015] As can be seen from the above technical solutions, this application provides a minute-level Trojan process location method, device, equipment, and medium. It achieves targeted fingerprint verification of monitored binary files through a Trojan tampering signature database and preset verification rules, realizing accurate non-full-disk detection. Verification is performed only on the monitoring program in the system to be repaired, eliminating the need to traverse all system files, significantly shortening scanning time and thus significantly improving the efficiency of Trojan process location. It quickly identifies kernel-level hidden modules through module anomaly rules and a hidden string database, and efficiently removes kernel-level hidden modules by combining batch unhiding strategies, making the Trojan process visible from a hidden state, providing a highly reliable environment for subsequent Trojan process location. Furthermore, through a dual location mechanism of process information tracing and non-full-disk targeted parallel scanning of high-frequency Trojan hiding directories, combined with cross-verification of abnormal file paths and abnormal files, it achieves accurate identification of Trojan process executable files and startup files, and detects and removes these files, effectively avoiding the misjudgment and missed detection problems that are prone to occur with single detection methods, ensuring the accuracy and reliability of the location results. Meanwhile, the non-full-disk directional parallel scanning focuses on high-risk directories, reducing system resource consumption and enabling rapid target file location within minutes, significantly improving location efficiency and effectively avoiding the low efficiency of traditional full-disk scanning. While ensuring location accuracy, it greatly improves detection and removal efficiency. This solution prioritizes the removal of core Trojan processes and quickly restores user business services, meeting the emergency response needs of production environments. It achieves rapid location and thorough removal of Trojans while minimizing business interruption time, effectively meeting the core needs of rapid response and timely business recovery in real-world scenarios. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a flowchart illustrating the minute-level Trojan process location method in this application embodiment; Figure 2 This is a structural diagram of the minute-level Trojan process locator in the embodiments of this application. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0019] The acquisition, storage, use, and processing of data in this application all comply with relevant laws and regulations.

[0020] In view of the problems existing in the prior art, this application provides a method, apparatus, device and medium for locating Trojan processes at the minute level. It performs targeted fingerprint verification of monitored binary files through a Trojan tampering signature database and preset verification rules, achieving accurate detection without a full system load. Verification is performed only on the monitoring program in the system to be repaired, eliminating the need to traverse all system files, significantly reducing scanning time and thus significantly improving the efficiency of Trojan process location. By using module anomaly rules and a hidden string database, kernel-level hidden modules are quickly identified, and combined with a batch unhiding strategy, kernel-level hidden modules are efficiently removed, making the Trojan process visible from a hidden state, providing a highly reliable environment for subsequent Trojan process location. Furthermore, through a dual location mechanism of process information tracing and non-full-disk targeted parallel scanning of high-frequency Trojan hiding directories, combined with cross-verification of abnormal file paths and abnormal files, accurate identification of Trojan process executable files and startup files is achieved, and these executable and startup files are detected and removed. This effectively avoids the misjudgment and missed detection problems that are prone to occur with single detection methods, ensuring the accuracy and reliability of the location results. Meanwhile, the non-full-disk directional parallel scanning focuses on high-risk directories, reducing system resource consumption and enabling rapid target file location within minutes, significantly improving location efficiency and effectively avoiding the low efficiency of traditional full-disk scanning. While ensuring location accuracy, it greatly improves detection and removal efficiency. This solution prioritizes the removal of core Trojan processes and quickly restores user business services, meeting the emergency response needs of production environments. It achieves rapid location and thorough removal of Trojans while minimizing business interruption time, effectively meeting the core needs of rapid response and timely business recovery in real-world scenarios.

[0021] To improve the efficiency of Trojan location and removal, and to meet the core needs of rapid handling and timely business recovery in real-world scenarios, this application provides an embodiment of a minute-level Trojan process location method. See [link to embodiment]. Figure 1 The minute-level Trojan process location method specifically includes the following: Step S110: Construct a Trojan tampering signature library and a local cache pool for monitoring files. Based on the Trojan tampering signature library and preset verification rules, perform non-full-disk targeted fingerprint verification on the monitoring binary files in the system to be repaired to identify the system monitoring files modified by the Trojan process. Obtain the standard monitoring file corresponding to the system monitoring file from the local cache pool for monitoring files, and use the standard monitoring file to forcibly replace the system monitoring file in order to rebuild a trusted system monitoring environment.

[0022] The system includes several key components: a Trojan tampering signature database (database storing standard information such as hash fingerprints, file sizes, permissions, and modification times of system monitoring files to determine if monitoring binary files have been modified by Trojans), a local monitoring file cache pool (a clean, untampered backup library of standard monitoring files stored locally for direct replacement of Trojan-damaged binary files), pre-defined verification rules (pre-set rules and system commands for verifying the normality of monitoring binary files), a target server or host that has been compromised by Trojans, contains hidden kernel modules, and requires cleanup and repair), monitoring binary files (files of monitoring programs in the system to be repaired, including programs for viewing processes, resources, and networks such as system process monitors, process status query programs, file attribute modifiers, file attribute viewers, firewall rule configuration programs, system service management programs, network connection status viewers, and network socket viewers), and non-full-disk targeted fingerprint verification (scanning only the monitoring binary files within the system to be repaired, without scanning the entire system) to quickly identify modified monitoring binary files. System monitoring files refer to monitoring binary files modified by Trojans. Standard monitoring files are original, clean, and complete monitoring binary files of the same version as the system monitoring files, cached locally in the monitoring file cache pool, and used to replace the system monitoring files. Forced replacement means directly overwriting the Trojan-modified system monitoring files with clean standard monitoring files without additional queries, achieving rapid repair. A trusted system monitoring environment refers to a reliable system state where the monitoring program's monitoring binary files are not tampered with, process viewing programs or process monitoring programs can truthfully display all processes, and are no longer deceived by Trojans. Trojans are malicious programs that illegally occupy system computing resources for cryptocurrency mining and evade detection by modifying system files or hiding kernel modules.

[0023] Specifically, in the aforementioned step S110, the construction of the Trojan tampering signature library and the local cache pool for monitoring files includes: obtaining a set of standard monitoring files from a standard system of the same version as the system to be repaired; extracting the hash fingerprint, file size, file permissions, and file modification time of each standard monitoring file in the set; using the file size, file permissions, and file modification time as file attributes of the standard monitoring file; constructing a first correspondence between the standard monitoring file name, the hash fingerprint, and the file attributes; constructing a second correspondence between the standard monitoring file name and the standard monitoring file; constructing a Trojan tampering signature library based on each of the first correspondences; and constructing a local cache pool for monitoring files based on each of the second correspondences.

[0024] The standard system refers to a clean and complete normal system that is completely identical in version to the system to be repaired, has not been compromised, has not been tampered with, and is clean. The standard monitoring file set refers to a collection of clean monitoring binary files extracted from the standard system that are the same version as the monitoring files in the system to be repaired and have not been modified by malware. A hash fingerprint is a unique identifier for a file calculated using a hash algorithm; once the file content is modified, the hash fingerprint will change significantly, which can be used to determine whether the file has been tampered with. File size refers to the storage space occupied by the file. File permissions refer to the configuration of read, write, and execute permissions for the file in the system to be repaired. File modification time refers to the time when the file was last edited or updated. File attributes are auxiliary verification features composed of file size, file permissions, and file modification time. The first correspondence refers to the established association between the standard monitoring file name, hash fingerprint, and file attributes. The second correspondence refers to the established association between the standard monitoring file name and the standard monitoring file itself.

[0025] For example, obtaining a set of standard monitoring files from a standard system of the same version as the system to be repaired includes: obtaining a standard system of the same version as the system to be repaired, and filtering out a set of standard monitoring files belonging to the monitoring program from the file set corresponding to the standard system.

[0026] Therefore, this solution obtains a set of standard monitoring files that match the same version as the monitoring binary file set in the system to be repaired, and extracts multi-dimensional features such as hash fingerprints, file size, file permissions, and file modification time of each standard monitoring file in the set of standard monitoring files. It constructs differentiated correspondences to form a Trojan tampering feature library and a local cache pool of monitoring files. On the one hand, it provides an accurate and reliable verification benchmark for subsequent detection of whether the monitoring binary files in the system to be repaired have been tampered with by Trojans, avoiding misjudgments and missed detections caused by version inconsistencies or single features. On the other hand, it realizes the local backup of clean monitoring files, which can be quickly retrieved and replaced without relying on external resources. At the same time, feature construction is only performed on monitoring files, without the need for a full scan, saving system resources and improving processing efficiency. This lays a stable foundation for the subsequent reconstruction of a trusted system monitoring environment and rapid Trojan location.

[0027] Specifically, in step S110, the step of performing non-full-disk targeted fingerprint verification on the monitoring binary files in the system to be repaired based on the Trojan tampering feature library and preset verification rules to identify system monitoring files modified by the Trojan process includes: obtaining a set of monitoring binary files corresponding to the monitoring program in the system to be repaired; calculating the real-time hash fingerprint of each monitoring binary file in the set of monitoring binary files and obtaining the real-time file attributes of the monitoring binary files; obtaining the hash fingerprint and file attributes corresponding to the monitoring binary files from the Trojan tampering feature library; if the hash fingerprint is inconsistent with the real-time hash fingerprint or the real-time file attributes are inconsistent with the file attributes, the monitoring binary files are considered to have failed the feature library verification; executing the monitoring program by calling each verification command in the preset verification rules; if there is an abnormal verification command response, the monitoring binary files are considered to have failed the rule verification, and the monitoring binary files that fail the feature library verification or fail the rule verification are identified as system monitoring files modified by the Trojan process.

[0028] Among them, real-time hash fingerprint refers to the hash value actually calculated from the monitoring binary file obtained in real time in the system to be repaired. Real-time file attributes refer to the real-time file size, real-time file permissions, and real-time file modification time of the current monitoring binary file in the system to be repaired. Verification command refers to the system call command used to verify whether the monitoring program functions normally. Verification command response refers to the running result returned by the monitoring program after executing the verification command. Abnormal response refers to situations where the running result returned by the monitoring program contains errors, missing results, hidden information, or other illogical situations.

[0029] For example, when the real-time file size in the real-time file attributes is different from the file size in the file attributes, or the real-time file permissions in the real-time file attributes are different from the file permissions in the file attributes, or the real-time file modification time in the real-time file attributes is different from the file modification time in the file attributes, the real-time file attributes are considered to be inconsistent with the file attributes.

[0030] For example, the verification commands can be installation package verification commands, system process monitoring commands, system runtime query commands, file attribute viewing commands, process status query commands, file attribute modification commands, firewall rule configuration commands, and system service management commands. Invoking each verification command in the preset verification rules to execute the monitoring program includes: calling the installation package verification command to perform integrity verification on the installation package file in the monitoring program; if the installation package file is incomplete, an abnormal verification command is returned; calling the system process monitoring command to view the first load information of the monitoring program, and calling the system runtime query command to obtain the second load information of the monitoring program; if the first load information and the second load information are inconsistent, it is considered an abnormal verification command; and respectively calling the file attribute viewing command, process status query command, file attribute modification command, firewall rule configuration command, and system service management command to execute the sub-monitoring program corresponding to each command in the monitoring program, checking whether each command can start normally, run normally, and return complete and valid result information; if it does not start normally, or does not run normally, or does not return complete and valid result information, it is considered an abnormal verification command.

[0031] Furthermore, the sub-monitoring program corresponding to the file attribute viewing command is a file attribute viewing program; the sub-monitoring program corresponding to the process status query command is a process status query program; the sub-monitoring program corresponding to the file attribute modification command is a file attribute modification program; the sub-monitoring program corresponding to the firewall rule configuration command is a firewall rule configuration program; and the sub-monitoring program corresponding to the system service management command is a system service management program.

[0032] Therefore, this solution adopts a non-full-disk targeted fingerprint verification method, which only detects critical monitoring binary files in the system to be repaired, significantly reducing the system overhead of full-disk verification and significantly improving the detection speed of Trojans. By comparing the dual static features of hash fingerprints and file attributes, combined with dynamic verification by verification commands, a two-layer verification mechanism of "static features combined with dynamic functions" is formed. This mechanism can accurately identify system monitoring files that have been tampered with, replaced, or hijacked by Trojans, effectively avoiding the problems of easy bypassing, misjudgment, or missed detection by a single verification method. It provides accurate repair targets for the subsequent reconstruction of a trusted monitoring environment, ensures the reliability and accuracy of Trojan process location, and provides solid support for achieving minute-level Trojan process location.

[0033] Step S120: Based on the module anomaly rules and the hidden string library, it is confirmed that there is a Trojan hidden kernel module in the system to be repaired. The Trojan hidden kernel module in the system to be repaired is removed by using a batch unhiding strategy combined with security experience rules, so that the Trojan process is normally visible in the system to be repaired.

[0034] Among them, "module anomaly rules" refers to pre-defined rules used to determine whether a kernel module is a Trojan-hidden kernel module. "Hidden string library" refers to a feature library storing commonly used suspicious strings, signatures, and identifiers of Trojans and Trojan-hidden kernel modules, used for matching and identifying Trojan-hidden kernel modules. A Trojan-hidden kernel module is a malicious kernel program that runs at the system kernel level, used to hide Trojan processes, malicious files, and network connections, making them undetectable by monitoring programs. "Batch unhiding strategy" refers to sending special commands to the system to be repaired to batch unhide kernel-level hiding mechanisms, making previously hidden processes, modules, and files visible again. "Security experience rules" refers to handling rules based on actual Trojan intrusion cases, including standardized operating procedures such as kernel module uninstallation, blacklisting, and hiding mechanism repair. "Trojan process normal visibility" means that Trojan processes are no longer hidden by Trojan-hidden kernel modules and can be normally viewed by monitoring programs such as system process monitoring programs and process status query programs.

[0035] Specifically, in step S120 above, the step of confirming the presence of a Trojan-hidden kernel module in the system to be repaired based on module anomaly rules and a hidden string library includes: determining the set of loaded kernel modules in the system to be repaired; for each kernel module in the set, identifying the kernel module name based on the name anomaly rules in the module anomaly rules to determine whether the kernel module name is abnormal; if abnormal, the kernel module is considered to be a Trojan-hidden kernel module, and the system to be repaired contains a Trojan-hidden kernel module; identifying the process names and process paths in the system to be repaired based on the hidden string library to determine whether there are abnormal process names or abnormal process paths associated with the kernel module; if so, the kernel module is considered to be a Trojan-hidden kernel module; obtaining the visible process resource quantity and the actual load quantity of the system to be repaired; if the difference between the actual load quantity and the visible process resource quantity is greater than the preset load difference value in the module anomaly rules, the system to be repaired is considered to contain a Trojan-hidden kernel module.

[0036] The set of loaded kernel modules refers to all kernel modules that are loaded into memory and running in the kernel of the system to be repaired. This set includes normal system driver modules and potentially hidden Trojan kernel modules. A kernel module is a program module that runs at the kernel level of the system to be repaired and can directly control the underlying functions of the system. A kernel module can be a driver module required for normal system operation or a hidden Trojan kernel module implanted by a Trojan. Module anomaly rules include name anomaly rules and load difference rules. Name anomaly rules are used to determine whether a kernel module is a hidden Trojan kernel module based on its name. If the kernel module name is random gibberish, meaningless characters, or a known malicious module name, it is considered an anomaly. The kernel module name is the unique identifier of the kernel module. Normal kernel module names are standardized and have clear meanings. Trojan hidden kernel module names are often disguised as gibberish or ordinary filenames to evade detection. Load difference rules are used to define preset load differences. The hidden string library stores characteristic strings, suspicious identifiers, path keywords, and other feature information commonly used by Trojans and their hidden kernel modules. This information is used to match and identify strings related to process names and process paths to quickly locate hidden Trojan kernel modules. The process name refers to the identifier name of the program currently running in the system to be repaired. The process path refers to the specific location of the executable file corresponding to the process on the system disk. Visible process resource usage refers to the total amount of CPU, memory, and other system resources used by all processes that can be directly viewed through the monitoring program. Actual load refers to the total amount of CPU, memory, and other system resources actually used by the underlying system to be repaired.

[0037] For example, after obtaining the kernel module set, for each kernel module in the set, a kernel module-level verification is performed first. The kernel module name is checked one by one. If the kernel module name is random gibberish, meaningless characters, or matches a known Trojan-hidden kernel module name, the kernel module name is determined to be abnormal, and thus the kernel module is identified as a Trojan-hidden kernel module. This method uses the most intuitive module name characteristics to quickly and initially screen out obvious Trojan-hidden kernel modules, improving detection efficiency. Secondly, process-level verification is performed on the kernel modules to identify abnormal process names or abnormal process paths in the system to be repaired. Each kernel module is checked to see if it is associated with any abnormal process name or abnormal process path. If associated, the kernel module is considered a Trojan-hidden kernel module. This method uncovers indirect traces left by Trojan-hidden kernel modules at the process level, compensating for the shortcomings of "kernel module-level verification," reducing missed detections, and improving detection accuracy. Finally, system-level verification is performed, obtaining the visible process resource quantity and the actual load of the system to be repaired, and calculating the difference between the two. If the difference is greater than the preset load difference in the module anomaly rules, it is determined that there is a hidden process in the system, thus confirming that the system to be repaired contains a Trojan hiding a kernel module. This achieves indirect detection without feature matching from the perspective of system resource load, preventing Trojans from evading "kernel module-level verification" and "process-level verification" by disguising names or removing features, and further significantly improving detection accuracy while occupying only a small amount of verification time.

[0038] Therefore, by employing a three-tiered progressive detection approach—kernel module-level verification, process-level verification, and system-level verification—Trojan-hidden kernel modules can be identified in a progressively deeper and more precise manner. First, name-based features enable rapid initial screening, ensuring detection efficiency. Then, process association traces are combined to compensate for the shortcomings of single-dimensional verification, reducing the probability of missed detections. Finally, system load differences enable featureless indirect detection, effectively resisting Trojan disguise and evasion. This three-layered differentiated detection approach, with each layer progressively complementing the others, effectively avoids the problems of missed detections and false positives that are easily encountered with single detection methods, significantly improving the accuracy of identifying Trojan-hidden kernel modules. Furthermore, the detection process only targets kernel modules, process names, process paths, and system resource usage, eliminating the need for a full file scan of the system to be repaired. Detection can be completed in a short time, achieving high efficiency while maintaining high detection accuracy, laying a solid foundation for subsequent minute-level Trojan process location.

[0039] Specifically, in the aforementioned step S120, the step of using a batch unhiding strategy combined with security experience rules to remove the Trojan hidden kernel module in the system to be repaired includes: sending a batch unhiding instruction from the batch unhiding strategy to the system to be repaired, and treating any newly displayed kernel modules after the batch unhiding instruction is sent as Trojan hidden kernel modules; adding the Trojan hidden kernel module to the system module blacklist to prevent the Trojan hidden kernel module from being automatically loaded again, and simultaneously using the kernel uninstallation instruction from the security experience rules to uninstall the Trojan hidden kernel module from the system to be repaired, and repairing the system process enumeration mechanism that has been tampered with by the Trojan.

[0040] The batch unhiding command is a command sent to the system kernel to disable the hiding function and force the display of hidden Trojan kernel modules and processes. The newly displayed kernel modules are those that were not visible before the batch unhiding command was sent to the system to be repaired and only reappear afterward. The system module blacklist is a list of suspicious or malicious kernel modules that the system to be repaired is used to prevent loading; once a module is added, the system will refuse to load it. The kernel uninstall command is a command used to uninstall a specified Trojan kernel module from the kernel of the system to be repaired, stopping the Trojan kernel module from running and removing it from memory. The system process enumeration mechanism is the underlying mechanism used by the system to traverse and list all currently running processes. If the system process enumeration mechanism is tampered with by a Trojan, it will be unable to list all currently running processes. Once the system process enumeration mechanism is repaired, all currently running processes can be listed.

[0041] Therefore, this solution rapidly exposes hidden Trojan kernel modules through batch unhiding commands, and combines blacklisting, kernel uninstallation, and process enumeration mechanisms for repair, achieving a complete closed-loop disposal of hidden Trojan kernel modules. Specifically, by sending batch unhiding commands to make hidden Trojan kernel modules actively visible, it can accurately and quickly locate hidden Trojan kernel modules that are difficult to detect using traditional methods, while avoiding the inefficiency caused by complex feature matching; adding hidden Trojan kernel modules to the blacklist can prevent them from being reloaded from the root, and the kernel uninstallation command can achieve immediate removal; finally, by repairing the system process enumeration mechanism, the process hiding environment is completely eliminated, making the Trojan process visible again, providing a reliable foundation for subsequent location and isolation of Trojan processes. The overall processing flow for hidden Trojan kernel modules is highly automated and fast, and can complete kernel-level Trojan kernel module cleanup without a full scan, effectively ensuring system stability and business continuity, and providing key support for achieving minute-level Trojan process location.

[0042] Step S130: Perform a non-full-disk targeted parallel scan of the high-frequency hiding directory of Trojans in the system to be repaired by tracing process information and the security experience rules, and perform consistency verification on the scan results. Locate the executable file and startup file of the Trojan process within minutes, back up the executable file and startup file, migrate the executable file and startup file to a preset isolation directory, delete the executable file and startup file from the original directory, and temporarily restore user services.

[0043] Among these, process information tracing refers to the technique of tracing back the source, parent process, file location, and startup method of a visible Trojan process. High-frequency Trojan hiding directories refer to system directories where Trojans typically hide files; these are high-risk directories identified through long-term security practice. Non-full-disk targeted parallel scanning refers to scanning only key directories of the system to be repaired, without scanning all directories, and simultaneously launching multiple scan tasks to improve scanning speed. Location within minutes refers to a technique that can quickly locate the Trojan within minutes, suitable for rapid repair in production environments. The executable file of a Trojan process refers to the malicious program itself that actually runs the Trojan algorithm and consumes computing power. The startup file of a Trojan process refers to the script or configuration file used to automatically run and periodically launch the Trojan process after the system to be repaired boots up. A preset isolation directory is a pre-set secure directory specifically for storing suspicious files; files moved to the preset isolation directory cannot be executed. The original directory refers to the directory where the executable file and startup file were located before being migrated to the isolation directory. Temporary restoration of user services refers to restoring the operation of business, websites, applications, etc. of the system to be repaired before the Trojan is completely removed, in order to reduce business losses.

[0044] Specifically, in step S130, the process of performing a non-full-disk targeted parallel scan of the high-frequency Trojan hiding directory in the system to be repaired using process information tracing and the security experience rules, and performing consistency verification on the scan results to locate the executable file and startup file of the Trojan process within minutes, includes: finding multiple processes to be verified after the Trojan's hidden kernel module is uninstalled; filtering out Trojan processes with high resource consumption from the multiple processes to be verified; tracing the process information of the Trojan process based on process resource consumption, parent-child process relationship, and network connection characteristics to locate multiple abnormal file paths corresponding to the Trojan process; performing a non-full-disk targeted parallel scan of the high-frequency Trojan hiding directory based on the security experience rules to identify multiple abnormal files with abnormal names, abnormal permissions, and suspicious startup; performing consistency cross-verification between the multiple abnormal file paths and the multiple abnormal files; determining the executable file as the running file directly corresponding to the Trojan process among the commonly hit files; and determining the startup file as the file used to implement the self-starting and persistence of the Trojan program among the commonly hit files.

[0045] Among them, the process to be verified refers to the process that reappears after the Trojan's hidden kernel module is uninstalled, a process that was hidden before the uninstallation. A Trojan process with high resource consumption refers to a process with high CPU and memory usage. Parent-child process relationship refers to the startup and calling relationship between processes, used to trace the executable and startup files. Network connection characteristics refer to the network behavior characteristics of the Trojan process when connecting to the mining pool. Abnormal file path refers to the path where the executable or startup file corresponding to the Trojan process is located.

[0046] For example, when tracing the source of a Trojan process, the paths of the executable and startup files corresponding to the Trojan process are traced backward based on information such as the Trojan process's resource usage, parent-child process relationship, and network connection. Based on the aforementioned security rules, when performing a non-full-disk targeted parallel scan of the Trojan's frequently hidden directory, the file names in the frequently hidden directory are detected based on abnormal process characters in the security rules. If a file name matches an abnormal process character, the file corresponding to that file name is identified as an abnormal file with an abnormal name. The permissions of each file in the frequently hidden directory are detected based on the permission configuration rules in the security rules. If a file's permissions do not conform to the permission configuration rules, the file corresponding to that file is considered an abnormal file with abnormal permissions. The startup configuration of each file in the frequently hidden directory is detected based on the suspicious startup rules in the security rules. If a file's startup configuration conforms to the suspicious startup rules, the file corresponding to that file's startup configuration is considered an abnormal file with suspicious startup. Multiple abnormal files with abnormal names, abnormal permissions, and suspicious startup are then combined based on these abnormal files.

[0047] Therefore, this solution employs a dual-location mechanism—process information tracing and non-full-disk targeted parallel scanning of high-frequency Trojan hiding directories—combined with cross-validation of abnormal file paths and abnormal files, to accurately identify Trojan process executables and startup files. This effectively avoids the misjudgments and missed detections that are prone to occur with single detection methods, ensuring the accuracy and reliability of the location results. Simultaneously, the non-full-disk targeted parallel scanning focuses on high-risk directories, reducing system resource consumption and enabling rapid target file location within minutes, significantly improving location efficiency and adapting to the rapid repair needs of production environments. Furthermore, by accurately distinguishing between Trojan executable programs and self-starting persistent files, a clear target is provided for subsequent thorough removal and prevention of recurrence. The overall location process is highly automated with minimal impact on business operations, quickly pinpointing the root cause of the threat and laying a reliable foundation for subsequent isolation, deletion, and restoration of user services.

[0048] In some examples, after temporarily restoring user services in step S130, the method further includes: traversing a first set of hash values ​​for all files in the system to be repaired, and calculating a second set of hash values ​​for all files in a standard system of the same version as the system to be repaired; identifying files with abnormal hash values ​​that exist in the first set of hash values ​​but not in the second set of hash values ​​as abnormal files; deleting the abnormal files; and performing security hardening on firewall policies, remote login permissions, and system startup configurations in the system to be repaired.

[0049] The first hash value set refers to the set of hash values ​​corresponding to all files in the system to be repaired. The second hash value set refers to the set of hash values ​​corresponding to all files in a standard clean system that is completely identical to the version of the system to be repaired. Abnormal hash values ​​refer to hash values ​​in the system to be repaired that cannot be matched with normal files in the standard system, i.e., files that have been modified or added in the system to be repaired. Security hardening refers to optimizing and configuring critical protection points of the system to be repaired to improve security and prevent Trojan re-intrusion. Firewall policy refers to optimizing firewall rules and strategies to block malicious network connections. Remote login permissions refer to restricting remote login accounts, increasing password complexity, and closing unnecessary remote login ports. System startup configuration refers to cleaning up malicious startup items and preventing Trojan programs and malicious modules from starting automatically.

[0050] Therefore, this solution achieves a comprehensive screening of system files through hash value comparison, compensating for the shortcomings of previous steps that only targeted core files related to Trojans. It can accurately identify and remove malicious files and redundant abnormal files left by Trojans, reducing the risk of Trojan residue at its source. At the same time, through security hardening through firewalls, remote login, and auto-start configuration, a system protection barrier is built to prevent Trojans from re-intruding, hiding, or auto-starting, thus improving system security and stability. In addition, the comprehensive screening of system files does not require a full scan of all file contents, but only compares hash values, balancing detection comprehensiveness and efficiency. It avoids missing malicious files without consuming excessive system resources. While further ensuring the thorough removal of Trojan processes and reducing the risk of system re-intrusion, it significantly improves the overall efficiency of Trojan removal, adapting to the core needs of rapid repair and low-impact handling in production environments.

[0051] In summary, this solution utilizes a Trojan tampering signature database and preset verification rules to perform targeted fingerprint verification on monitored binary files, achieving accurate non-full-disk detection. Verification is performed only on the monitoring program in the system to be repaired, eliminating the need to traverse all system files, significantly reducing scan time and thus greatly improving the efficiency of Trojan process location. By using module anomaly rules and a hidden string database to quickly identify kernel-level hidden modules, and combining this with a batch unhiding strategy, kernel-level hidden modules are efficiently removed, making the Trojan process visible and providing a highly reliable environment for subsequent Trojan process location. Furthermore, through a dual location mechanism of process information tracing and non-full-disk targeted parallel scanning of high-frequency Trojan hiding directories, combined with cross-verification of abnormal file paths and abnormal files, accurate identification of Trojan process executable files and startup files is achieved, and these executable and startup files are then removed. This effectively avoids the misjudgment and missed detection problems that are prone to occur with single detection methods, ensuring the accuracy and reliability of the location results. Meanwhile, the non-full-disk directional parallel scanning focuses on high-risk directories, reducing system resource consumption and enabling rapid target file location within minutes, significantly improving location efficiency and effectively avoiding the low efficiency of traditional full-disk scanning. While ensuring location accuracy, it greatly improves detection and removal efficiency. This solution prioritizes the removal of core Trojan processes and quickly restores user business services, meeting the emergency response needs of production environments. It achieves rapid location and thorough removal of Trojans while minimizing business interruption time, effectively meeting the core needs of rapid response and timely business recovery in real-world scenarios.

[0052] To improve the efficiency of Trojan location and removal, and to meet the core needs of rapid handling and timely business recovery in real-world scenarios, this application provides an embodiment of a minute-level Trojan process location device for implementing all or part of the aforementioned minute-level Trojan process location method. See [link to embodiment]. Figure 2The minute-level Trojan process location device specifically includes the following components: The construction unit 10 is used to construct a Trojan tampering signature library and a local cache pool for monitoring files. Based on the Trojan tampering signature library and preset verification rules, it performs non-full-disk targeted fingerprint verification on the monitoring binary files in the system to be repaired, identifies the system monitoring files modified by the Trojan process, obtains the standard monitoring file corresponding to the system monitoring file from the local cache pool for monitoring files, and uses the standard monitoring file to forcibly replace the system monitoring file in order to rebuild a trusted system monitoring environment.

[0053] Confirmation unit 20 is used to confirm the existence of a Trojan hidden kernel module in the system to be repaired based on module anomaly rules and hidden string library, and to remove the Trojan hidden kernel module in the system to be repaired by using a batch unhiding strategy combined with security experience rules, so that the Trojan process is normally visible in the system to be repaired. The positioning unit 30 is used to perform a non-full-disk targeted parallel scan of the high-frequency hiding directory of Trojans in the system to be repaired by tracing process information and the security experience rules, and to perform consistency verification on the scan results. Within a minute, it locates the executable file and startup file of the Trojan process, backs up the executable file and startup file, migrates the executable file and startup file to a preset isolation directory, deletes the executable file and startup file from the original directory, and temporarily restores user services.

[0054] As described above, the minute-level Trojan process location device provided in this application can perform targeted fingerprint verification of monitored binary files through a Trojan tampering signature database and preset verification rules, achieving accurate non-full-disk detection. It only verifies the monitoring program in the system to be repaired, eliminating the need to traverse all system files, significantly reducing scanning time and thus significantly improving Trojan process location efficiency. By using module anomaly rules and a hidden string database to quickly identify kernel-level hidden modules, and combining this with a batch unhiding strategy to efficiently remove kernel-level hidden modules, the Trojan process is made visible from its hidden state, providing a highly reliable environment for subsequent Trojan process location. Furthermore, through a dual location mechanism of process information tracing and non-full-disk targeted parallel scanning of high-frequency Trojan hiding directories, combined with cross-verification of abnormal file paths and abnormal files, accurate identification of Trojan process executable files and startup files is achieved, and these executable and startup files are detected and eliminated. This effectively avoids the misjudgment and missed detection problems that are prone to occur with single detection methods, ensuring the accuracy and reliability of the location results. Meanwhile, the non-full-disk directional parallel scanning focuses on high-risk directories, reducing system resource consumption and enabling rapid target file location within minutes, significantly improving location efficiency and effectively avoiding the low efficiency of traditional full-disk scanning. While ensuring location accuracy, it greatly improves detection and removal efficiency. This solution prioritizes the removal of core Trojan processes and quickly restores user business services, meeting the emergency response needs of production environments. It achieves rapid location and thorough removal of Trojans while minimizing business interruption time, effectively meeting the core needs of rapid response and timely business recovery in real-world scenarios.

[0055] To further illustrate this solution, this application also provides a specific application example of using the aforementioned minute-level Trojan process locating device to implement the minute-level Trojan process locating method, which specifically includes the following: In some embodiments, when the apparatus is used to construct the Trojan tampering signature library and the local cache pool for monitoring files, it is specifically used to: obtain a set of standard monitoring files from a standard system of the same version as the system to be repaired; for each standard monitoring file in the set of standard monitoring files, extract the hash fingerprint, file size, file permissions, and file modification time of the standard monitoring file; use the file size, file permissions, and file modification time as file attributes of the standard monitoring file; construct a first correspondence between the standard monitoring file name, the hash fingerprint, and the file attributes; construct a second correspondence between the standard monitoring file name and the standard monitoring file; construct a Trojan tampering signature library based on each of the first correspondences; and construct a local cache pool for monitoring files based on each of the second correspondences.

[0056] In some embodiments, when the device is used to perform non-full-disk targeted fingerprint verification on monitoring binary files in the system to be repaired based on the Trojan tampering signature library and preset verification rules, and to identify system monitoring files modified by the Trojan process, the device is specifically used to: obtain a set of monitoring binary files corresponding to the monitoring program in the system to be repaired; calculate the real-time hash fingerprint of each monitoring binary file in the set of monitoring binary files, and obtain the real-time file attributes of the monitoring binary files; obtain the hash fingerprint and file attributes corresponding to the monitoring binary files from the Trojan tampering signature library; if the hash fingerprint is inconsistent with the real-time hash fingerprint or the real-time file attributes are inconsistent with the file attributes, the monitoring binary files are considered to have failed the signature library verification; execute the monitoring program by calling each verification command in the preset verification rules; if there is an abnormal verification command response, the monitoring binary files are considered to have failed the rule verification, and the monitoring binary files that fail the signature library verification or fail the rule verification are identified as system monitoring files modified by the Trojan process.

[0057] In some embodiments, when the device is used to confirm the presence of a Trojan-hidden kernel module in the system to be repaired based on module anomaly rules and a hidden string library, it is specifically used to: determine the set of loaded kernel modules in the system to be repaired; for each kernel module in the set of kernel modules, identify the kernel module name of the kernel module based on the name anomaly rule in the module anomaly rules to determine whether the kernel module name is abnormal; if abnormal, the kernel module is considered to be a Trojan-hidden kernel module, and the system to be repaired has a Trojan-hidden kernel module; identify the process names and process paths in the system to be repaired based on the hidden string library to determine whether there are abnormal process names or abnormal process paths associated with the kernel module; if so, the kernel module is considered to be a Trojan-hidden kernel module; obtain the visible process resource quantity and the actual load quantity of the system to be repaired; if the difference between the actual load quantity and the visible process resource quantity is greater than the preset load difference value in the module anomaly rules, the system to be repaired is considered to have a Trojan-hidden kernel module.

[0058] In some embodiments, when the device is used to remove the Trojan-hidden kernel module present in the system to be repaired by combining the batch unhiding strategy with security experience rules, it is specifically used to: send a batch unhiding instruction in the batch unhiding strategy to the system to be repaired, and regard the kernel module newly displayed after the batch unhiding instruction is sent as the Trojan-hidden kernel module; add the Trojan-hidden kernel module to the system module blacklist to prevent the Trojan-hidden kernel module from being automatically loaded again, and at the same time use the kernel uninstallation instruction in the security experience rules to uninstall the Trojan-hidden kernel module from the system to be repaired, and repair the system process enumeration mechanism tampered with by the Trojan.

[0059] In some examples, when the device is used to perform a non-full-disk targeted parallel scan of the high-frequency Trojan hiding directory in the system to be repaired by tracing process information and the security experience rules, and to perform consistency verification on the scan results, and to locate the executable file and startup file of the Trojan process within a minute, the specific steps are as follows: First, find multiple processes to be verified that are newly added after the Trojan's hidden kernel module is uninstalled. Then, filter out Trojan processes with high resource consumption from the multiple processes to be verified. Next, trace the process information of the Trojan process based on process resource consumption, parent-child process relationships, and network connection characteristics to locate multiple abnormal file paths corresponding to the Trojan process. Finally, based on the security experience rules, perform a non-full-disk targeted parallel scan of the high-frequency Trojan hiding directory to identify multiple abnormal files with abnormal names, abnormal permissions, and suspicious startup. Perform consistency cross-verification between the multiple abnormal file paths and the multiple abnormal files. Among the commonly matched files, determine the executable file as the running file directly corresponding to the Trojan process. Finally, determine the startup file as the file used to implement the self-starting and persistence of the Trojan program among the commonly matched files.

[0060] In some examples, after temporarily restoring user services, the device is also used to: traverse a first set of hash values ​​for all files in the system to be repaired, and calculate a second set of hash values ​​for all files in a standard system of the same version as the system to be repaired; identify files with abnormal hash values ​​that exist in the first set of hash values ​​but not in the second set of hash values ​​as abnormal files; delete the abnormal files; and perform security hardening on firewall policies, remote login permissions, and system startup configurations in the system to be repaired.

[0061] This invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the minute-level Trojan process location method.

[0062] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned minute-level Trojan process location method.

[0063] This invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements the above-described minute-level Trojan process location method.

[0064] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0065] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0066] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0067] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0068] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for locating Trojan processes at the minute level, characterized in that, The method includes: A set of standard monitoring files from a standard system of the same version as the system to be repaired is obtained. For each standard monitoring file in the set, its hash fingerprint, file size, file permissions, and file modification time are extracted. The file size, file permissions, and file modification time are used as file attributes of the standard monitoring file. A first correspondence between the standard monitoring file name, the hash fingerprint, and the file attributes is constructed, and a second correspondence between the standard monitoring file name and the standard monitoring file is constructed. A Trojan tampering feature library is constructed based on each of the first correspondences, and a monitoring file local cache pool is constructed based on each of the second correspondences. Based on the Trojan tampering feature library and preset verification rules, targeted fingerprint verification is performed only on the monitoring binary files in the system to be repaired to achieve non-full-disk targeted fingerprint verification of the system to be repaired, identifying system monitoring files modified by Trojan processes. A standard monitoring file corresponding to the system monitoring file is obtained from the monitoring file local cache pool, and the standard monitoring file is used to forcibly replace the system monitoring file. The targeted fingerprint verification refers to performing hash fingerprint verification, file attribute verification, and rule verification. Based on the module anomaly rules and the hidden string library, it was confirmed that the system to be repaired contained a Trojan hidden kernel module. The Trojan hidden kernel module in the system to be repaired was removed by using a batch unhiding strategy combined with security experience rules, so that the Trojan process could be seen normally in the system to be repaired. By tracing process information and using the security experience rules, a non-full-disk targeted parallel scan is performed on the high-frequency hiding directory of Trojans in the system to be repaired. The scan results are then verified for consistency. Within minutes, the executable file and startup file of the Trojan process are located, the executable file and startup file are backed up, the executable file and startup file are migrated to a preset isolation directory, the executable file and startup file are deleted from the original directory, and user services are temporarily restored.

2. The method for locating minute-level Trojan processes according to claim 1, characterized in that, The method of performing targeted fingerprint verification on monitoring binary files in the system to be repaired based on the Trojan tampering signature database and preset verification rules is to achieve non-full-disk targeted fingerprint verification of the system to be repaired, and to identify system monitoring files modified by the Trojan process, including: Obtain the set of monitoring binary files corresponding to the monitoring program in the system to be repaired; for each monitoring binary file in the set of monitoring binary files, calculate the real-time hash fingerprint of the monitoring binary file and obtain the real-time file attributes of the monitoring binary file. Obtain the hash fingerprint and file attributes corresponding to the monitored binary file from the Trojan tampering feature library. If the hash fingerprint is inconsistent with the real-time hash fingerprint or the real-time file attributes are inconsistent with the file attributes, the monitored binary file is considered to have failed the feature library verification. The monitoring program executes the verification commands in the preset verification rules. If there is an abnormal verification command response, the monitoring binary file is considered to have failed the rule verification. The monitoring binary file that fails the feature library verification or fails the rule verification is identified as a system monitoring file modified by a Trojan process.

3. The method for locating minute-level Trojan processes according to claim 1, characterized in that, The Trojan-hidden kernel modules identified in the system to be repaired based on module anomaly rules and a hidden string library include: The set of loaded kernel modules in the system to be repaired is determined. For each kernel module in the set of kernel modules, the kernel module name is identified based on the name anomaly rule in the module anomaly rule to determine whether the kernel module name is abnormal. If it is abnormal, the kernel module is considered to be a Trojan hidden kernel module, and the system to be repaired has a Trojan hidden kernel module. The process names and paths in the system to be repaired are identified based on a hidden string library to determine whether there are any abnormal process names or abnormal process paths associated with the kernel module. If so, the kernel module is considered to be a Trojan-hidden kernel module. Obtain the visible process resource quantity and the actual load quantity of the system to be repaired. If the difference between the actual load quantity and the visible process resource quantity is greater than the preset load difference value in the module anomaly rule, then the system to be repaired is considered to have a Trojan hidden kernel module.

4. The method for locating minute-level Trojan processes according to claim 1, characterized in that, The method of using batch unhiding strategies combined with security experience rules to remove Trojan hidden kernel modules in the system to be repaired includes: By sending a batch unhiding command from the batch unhiding strategy to the system to be repaired, the kernel modules newly displayed after the batch unhiding command is sent are regarded as Trojan hidden kernel modules. The Trojan's hidden kernel module is added to the system module blacklist to prevent it from being automatically loaded again. At the same time, the kernel uninstallation command in the security experience rules is used to uninstall the Trojan's hidden kernel module from the system to be repaired, and the system process enumeration mechanism that was tampered with by the Trojan is repaired.

5. The method for locating minute-level Trojan processes according to claim 1, characterized in that, The process involves tracing process information and applying security rules to perform a non-full-disk, targeted, parallel scan of the high-frequency hiding directories of Trojans in the system to be repaired. The scan results are then validated for consistency. Within minutes, the executable and startup files of the Trojan processes are located, including: After uninstalling the Trojan's hidden kernel module, multiple processes to be verified are newly displayed. Trojan processes with high resource consumption are selected from these processes. Based on process resource consumption, parent-child process relationship, and network connection characteristics, the Trojan processes are traced to locate multiple abnormal file paths corresponding to the Trojan processes. Based on the aforementioned security experience rules, a non-full-disk targeted parallel scan is performed on the high-frequency hiding directory of Trojans to identify multiple abnormal files with abnormal names, abnormal permissions, and suspicious startup. The paths of the multiple abnormal files are cross-checked for consistency with the multiple abnormal files. Among the files that are commonly hit, the running file that directly corresponds to the Trojan process is determined as the executable file. Among the files that are commonly hit, the file used to enable the self-starting and persistence of the Trojan program is determined as the startup file.

6. The method for locating minute-level Trojan processes according to claim 1, characterized in that, After temporarily restoring user services, the method further includes: Traverse the first hash value set of all files in the system to be repaired, and calculate the second hash value set of all files in the standard system of the same version as the system to be repaired. Files with abnormal hash values ​​that exist in the first hash value set but not in the second hash value set are identified as abnormal files. Delete the abnormal files and strengthen the firewall policies, remote login permissions, and system startup configurations of the system to be repaired.

7. A minute-level Trojan process location device, characterized in that, The device includes: A construction unit is used to acquire a set of standard monitoring files from a standard system of the same version as the system to be repaired. For each standard monitoring file in the set, the hash fingerprint, file size, file permissions, and file modification time of the standard monitoring file are extracted. The file size, file permissions, and file modification time are used as file attributes of the standard monitoring file. A first correspondence between the standard monitoring file name, the hash fingerprint, and the file attributes is constructed, and a second correspondence between the standard monitoring file name and the standard monitoring file is constructed. A Trojan tampering feature library is constructed based on each of the first correspondences, and a monitoring file local cache pool is constructed based on each of the second correspondences. Based on the Trojan tampering feature library and preset verification rules, targeted fingerprint verification is performed only on the monitoring binary files in the system to be repaired to achieve non-full-disk targeted fingerprint verification of the system to be repaired, identify the system monitoring files modified by the Trojan process, acquire the standard monitoring file corresponding to the system monitoring file from the monitoring file local cache pool, and forcibly replace the system monitoring file with the standard monitoring file. The targeted fingerprint verification refers to performing hash fingerprint verification, file attribute verification, and rule verification. The confirmation unit is used to confirm the presence of a Trojan hidden kernel module in the system to be repaired based on module anomaly rules and a hidden string library, and to remove the Trojan hidden kernel module in the system to be repaired by using a batch unhiding strategy combined with security experience rules, so that the Trojan process is normally visible in the system to be repaired. The location unit is used to perform a non-full-disk targeted parallel scan of the high-frequency hiding directory of Trojans in the system to be repaired by tracing process information and the security experience rules, and to perform consistency verification on the scan results. Within a minute, it locates the executable file and startup file of the Trojan process, backs up the executable file and startup file, migrates the executable file and startup file to a preset isolation directory, deletes the executable file and startup file from the original directory, and temporarily restores user services.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the minute-level Trojan process location method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the minute-level Trojan process location method according to any one of claims 1 to 6.

Images